> If your field has to be named "User" to be public, and the corresponding entry in the JSON has all-lowercase "user" as the key

then you specify the key to be "user"? Isn't that the point of the ability to remap names? Except you can't, because you don't have a choice whether or not your data is deserialised with case sensitivity enabled or not.

I've written plenty of Rust code to turn camelCase into snake_case and "it's too much effort" has never been a problem. It's a minor bother that helps prevents real security issues like the ones listed in this article.

Even if you want to help lazy programmers, I don't think there's a good reason to confuse "User" and "uſER" by default.