The TLDR here is that, yes, this was an implementation error, much as Monero made an implementation error in not checking the order of points, using the same curve with cofactor 8. in both cases the errors were patched. But the errors were very easy to miss and absolutely disastrous, especially in the libgcrypt case, allowing cracking of keys in seconds for any process that was sharing the same RAM. Others, like JP Aumassin (author of the excellent 'Serious Cryptography'), and apparently Matt Green, apparently shared, partly, my skepticism about not validating inputs: https://research.kudelskisecurity.com/2017/04/25/should-ecdh-keys-be-validated/ which btw links to this entertaining, concrete take on why not checking inputs is dodgy as hell:

Why not validate Curve25519 public keys could be harmful

Update: see this post for a real world protocol that is broken if Curve25519 public keys are not validated. Update: comments on Twitter ....