Note that this is not security sensitive code. The actual security boundary is at runtime. This is just the type checker assisting the developer, predicting what the runtime enforcement will allow/reject.
Allowing any here aligns with TypeScript's general type checking principles, where you're allowed to do just about anything you want with an any typed value.
From the CL description:
This upstreams http://cl/354348347.