I think you're mostly right. I don't have much defense against this other than just accounting for total disaster situations as part of some bigger-picture risk model. There were some mild things I could've done to limit exposure, but the crux of your argument is mostly true. I wasn't using a retail broker, but the prop shop front-ends out there are effectively no better than a retail broker. Some of my fill / order ack times can be pretty horrendous and variable, particularly in fast markets. I may just need to start profiling my latency and just flat out shut down if the profile just becomes absurd.
That's the most important validation routine to run IMHO. If the data you are processing is stale you don't have a fucking clue what is happening at the exchange and your dick is left flapping in the wind. Worst bug I caught involved an edge case I hadn't considered. Led to a loop being entered in which opposing positions were entered and exited. Generated 100s of orders per second. Discovered it in my testbed environment thank Christ. Developed an independent order monitoring application pretty quickly after that to sanity check order generation frequency amongst other things.