I guess the assumption is that bad actors have access to the data anyway so putting such verification process is not deterring any bad actor in any way