It's "fine" is you ignore adversarial situations.

If someone is taking malicious stabs at your API then you have a problem

Yeah, absolutely. I would be worried about a JSON parser facing the internet that had these kinds of problems, for example. But it's only the very first in a long line of potential vulnerabilities such a system has to consider.

What good is a perfect linear-time constant-space parser if the next thing the system does is to allocate hundreds of megabytes of objects representing some deserialized data structure?

The parser is usually the least interesting part.