I'm only saying that validation depends on validating the event id AND the signature. Only doing half validation is exactly as secure as doing neither.

But regardless, I think validation is mandatory at any performance penalty.