`get_object_for_email` is public API and should never return unrestricted objects. I expect all APIs to respect security by default. We'd also have to rewrite it for gever anyway - and I don't think that we'd disable sender validation in gever ever.