Why even use HTTP, when you can just send bytes directly over the physical network card, right?
Because standards make it better for everyone. You've no idea when, who or in what context the error will happen or be received by.
It takes so little to return ProblemDetails, and improves the experience of devs using your API so much. Just do it. Stop thinking up edge cases and faffing about with excuses. Do it.
Sorry to say, but if you put it on the internet the AI bots are going to gobble it down.
Only way to protect it is to not put it on the public net. If you add a challenge (login or something) it might stay unmolested, but that's no longer a static site.
Too hard to validate properly to be worth it. Even if it is technically valid that's insufficient. It must also work, and the easiest way to test that is to use it and verify that the user got what we sent.
Surely you'd need a non-binary tree?