There’s a difference between ‘I would rather the user didn’t do that’ and ‘We must not allow this to happen’.
User enters the empty string for their password recovery question? Don’t care. Let the Frontend handle this. If the user is capable enough to disable the frontend validation, they’re capable to remember their password.
User enters SQL as their password recovery question? Validate in the backend.