Are widget arguments always set inside My_Widget::widget()?

This is mostly a case of trusting the arguments. Or not trusting.

  • You can assume that you have received meaningful arguments, ready to be used.
  • You can assume they are arbitrary and possibly grossly invalid.

I would say in this specific case it hangs if the code is public or private. In private site you have the full control over it, from sidebar registration to widget output.

Making widget for public distribution, I reason, would require much more strict checks and making sure it doesn’t fall apart on receiving unexpected inputs.