Should Appendix A.5 incorporate Parsing of untrusted inputs?

Appendix A.5, Security Considerations, introduces its list with "The following security considerations from OpenID4VP apply:" and then names eight: Sections 14.2, 14.5, 14.6, 14.7, 14.8, 14.11, 14.12 and 15.4.1. Section 14.13, Parsing of untrusted inputs, is not among them, and I could not find it referenced anywhere else inside Appendix A.

That matters because of what Section 14.13 requires:

Wallets MUST treat all incoming requests as untrusted input. To mitigate injection and resource exhaustion attacks, Wallets MUST implement input validation on the Authorization Request and its enclosed DCQL query.

and because of how the Introduction scopes the appendix:

Except where it explicitly references other sections of this specification, that section is self-contained, and its implementers can ignore the rest of the specification.

Taken with the position recorded on #599, that Appendix A.2 is separate and fully self-contained and that main-body sections do not apply unless Appendix A references them directly, a Wallet built strictly to Appendix A is not bound by either of those two requirements. Appendix A is also the one profile in which the caller can be any web origin, so it is the profile where treating the request as untrusted matters most.

The list does not read as a bare set of pointers either. Two of the eight entries are adjusted individually: the replay entry carries "with the difference that the origin is used instead of the Client Identifier to bind the response to the Client", and the Client Identifier entry is narrowed to "for signed requests".

Should Section 14.13 be in this list, or is its exclusion deliberate?

Read Appendix A.5, Section 14.13, and the scope discussion recorded in #599. Compare the listed security considerations with the appendix's self-containedness claim and determine whether the omission is intentional; done means clarifying the specification's reference list or documenting the rationale for excluding Section 14.13.