I am not sure we have a consistent policy of being careful about these things (though that wouldn't be a bad idea),
We should be, yes. It may not be particularly easy to deliberately cause an overflow in this specific case, but the shaders we compile are potentially untrusted data, and we should treat them as such.