Yes very true. A lot of "traditional" validation is actually "attestation", where a manager at a release control board "attests" that a category of tests have passed. But were the tests sufficient? Were they realistic?

A better approach to validation is to attest _throughout_ the entire development process, by having independent analysts attest to test sufficiency criteria, and having tests performed throughout development, so that history is accumulated. The latter (testing throughout development) is essentially the "continuous delivery" approach, although it often fails to include the former (use of test sufficiency criteria).