JS validation is the catch-all of all data coming through the ORB safelist check, and it's supposed to block not just JSON, but also all other incoming data not parsable as JavaScript, e.g. a font file, some random huge ISO and so on.

By doing an early check for failure, we can block a malicious site ("http://evil.site") from doing a huge Window.fetch("http://lawful.site/path-to-a-huge.iso", {mode: "no-cors"}), probably on the first OnDataAvailable. This way we'll decrease network traffic for the user, as well as saving CPU-cycles, and also prevent evil.site from DDoS'ing lawful.site.