It doesn't make any business sense to do it any other way. Checking if requests are valid costs money. Following requests blindly costs almost nothing, just a single internet page is lost out of millions. Google makes money off the long tail of advertising, a huge amount that flies under the radar of personal wine and dine deals. They know very well they can't afford to check every request personally.