Why must every Server Function perform its own validation and authorization?

Direct answer

Server Function arguments are client-controlled network input, so the function must validate data and verify that the authenticated user is authorized to perform the requested mutation.

project-actions.js

export async function deleteProject(projectId) {
  "use server";

  const user = await requireUser();

  const project = await db.project.find(projectId);

  if (!project || project.ownerId !== user.id) {
    throw new Error("Not authorized");
  }

  await db.project.delete(projectId);
}

Authenticate the caller on the server
Authorize access to the specific resource
Validate and normalize all submitted data
Return only data that is safe to serialize to the client

Don't

Trust a hidden form field as proof of ownership
Assume a function is private because the UI hides its button
Treat TypeScript types as runtime validation