Agreed, but maybe my mental model is splitting the 'Controller' aspect into the client / server model. Everything must get validated server side, there's no other rational choice. Otherwise you cannot enforce any consistency or business logic.

That just leaves formatting the requested changes into a language the server model accepts.

Maybe model is more 'database', controller is API interface (server side + client request requirements), and view is end user render?