Message.Deserialise(...) assumes a non-mutated, perfectly formatted message is provided.
If invalid data is provided, it will still try to parse the data and possibly have a fatal failure.
The CoAP specification clearly states multiple scenarios that need to be checked and reject or ignore the message.