This is intentional. Since the API requires authentication in order to use, it is assumed that you have full control over what is being submitted (and who is submitting it) so only the default validation routine is run (the same thing applies when creating reviews in the WP Admin, and when using the glsr_create_review function).
The following additional validation routines are run when a review is submitted using the review form as you will have less control over which values are submitted:
– CustomValidator
– PermissionValidator
– HoneypotValidator
– ReviewLimitsValidator
– BlacklistValidator
– AkismetValidator
– RecaptchaValidator
