Do I need to validate the nonce when using the settings api?

As mentioned I wasn’t able to find it explicitly mentioned, although it was implied in some articles, that it was being done.

When using the settings_fields( string $option_group ) wordpress function you can see from the source code that it includes a nonce field:

https://developer.wordpress.org/reference/functions/settings_fields/

function settings_fields( $option_group ) {
    echo "<input type="hidden" name="option_page" value="" . esc_attr( $option_group ) . "" />";
    echo '<input type="hidden" name="action" value="update" />';
    wp_nonce_field( "$option_group-options" );
}

I finally realised that if I changed the value of this nonce in the dev tools in the browser to another value and submitted the form then if it were being validated it should fail.

This was the case giving me a 403 response and a message that ‘The link you followed has expired.’

So I was reassured that the settings api does in fact validate this nonce and the warning in the Plugin Check was unnecessary.

I was surprised it was not more clearly mentioned in the docs or previous questions on here (or at least I couldn’t find by googling), I hope that this saves someone else some time! :-S