Maybe because they were probably already doing sanity checking, but the kind that relied on some previous context? That seems reasonable, I’m sure they’ve thought about this kind of attack before, missing an obscure edge case.