Correct, the client set validateSchema = false because, for example, we want NuGet 2.3 to support packages created by NuGet 2.4 or above. 

On the hand, the gallery always support the latest version of NuGet, so we should always validate schema to ensure all uploaded packages have valid schema. It'll also reduce any chance of exploit.