[YZF]

There are times when you want to build for robustness and times you want to be more concise. If you have control over the set of inputs (e.g. by formalizing it and using the right tools) that's great but there's usually some overhead involved in doing that. My argument would be that security is orthogonal to robustness - just because you accept input that is outside the originl specification doesn't mean that you should do that insecurely. The robust (liberal) implementation and the limited (conservative) implementation simply support different protocols, they can do either with security holes or without. Does this increase the attack "surface"? It may or may not.

A bigger problem is when the liberal implementations become the de-facto standard.