I think Exceptions should be handled where they can be handled. Input data should always be validated - on any level. Not doing this in the low level code is the cause of the majority of the security bugs. By example: buffer overflow, caused by the high level part (wrong data in the parameters), not checked and not handled in the low level code, and voila, we have a security problem.