MITM risk of not sanitizing?

This is the official answer from the WordPress Plugin Review Team:

PHP runs processes one at a time.

If step 1 is “Validate” and step 2 is save, then between step 1 and 2
is where a MITM happens.

Now. You may be thinking “But come on, nothing could possibly happen
there! That’s too fast!” And the probability is you are 99% correct.
But. is that 1% worth the risk? No. Not when you can just wrap it and
sanitize it and save yourself from a hacker more clever than you or I.

Remember a lot of santization is ‘Are you SURE?’ and really we never
are.

This is fine:

function add_cookie_to_order( $order_id ) { if ( isset(
$_COOKIE[‘tm_clickid’] ) && preg_match(
‘/^[A-Z][A-Z][A-Z]?[0-9a-f]{32}$/’, $_COOKIE[‘tm_clickid’] ) ) {
$tm_clickid = sanitize_text_field( $_COOKIE[‘tm_clickid’] );
update_post_meta( $order_id, ‘tm_clickid’, $tm_clickid ); } }

So you have to do it that way and pass the variable through the wordpress sanitize function, to have the plugin approved.