If You Use Twitch for Login to Your App, You Must Validate Every Request

API
2

As you say, the guidance is clear on what they require.
As with any API, you can do something contrary or undocumented, but don’t complain when your stuff breaks later because of it.