Validation Controls - How secure are they?

I have a co-worker who is paranoid.  The asp.Net validaton controls DO validate on the client, but they also validate on the server.  He insists on capturing the passed data on the server (on button click) and check it against the SAME regex that the validation control is based on.
I ensured him that the control validates on both client AND server.
Am I taking crazy pills? 
I need some ammo to shoot back with.
...