FYI: This is more common than you think.

I briefly worked with a company where I had to painfully explain to the lead engineer that you can't trust anything that comes from the browser; because a hacker can curl whatever they want.

Our relationship deteriorated from there. Needless to say, I don't list the experience on my resume.