Any protocol that "verifies the signature first, then parses" (including some JWT and WS-Security implementations) carries similar parser inconsistency risks, and the core defensive principle is that security decisions and business logic must be based on the same data view.