the last paragraph was probably most important one here, and the lesson is If you truly want to enforce a validation then it has to be in the backend, the client side validation is just additional luxury if you can afford it.

On a different note, the validations were added for genuine reasons and most likely there would be some discussions/debate on the scope/cost/benefits. I would imagine if some one were to do it a a business seriously then they would have some way to override it on use case basis.