A team says: "We validate all input with strict schemas, so we don't need parameterised queries or output encoding." What's wrong with this?

Valid input can still be dangerous in another context. So defences belong where the data is used. Many real values contain characters that are special in SQL, HTML or shell commands. For example, the name O'Brien contains a quote, which is special in SQL. Validation can't reject these values without breaking real users.

Validation is a first layer that narrows the input. Parameterised queries and encoding for each output context are what make data safe where it is used.

"Nothing; schema validation fully prevents injection" is wrong, because a valid value like O'Brien can still break a SQL query that is built from strings.