It's not about a small company,
it's about you. If _you_ are given a task to implement it, you can't just say: "Ah, it's only 5% of our database, we don't have to care." If you say so, you are bullshitting your customer/boss.
Any competent programmer should shudder at a solution like you suggested. Yes, you could leave 5% of the user input unvalidated if you absolutely don't have resources to implement validation. But _you_, the programmer, should explain the risks to your management and fight for a complete solution. You may lose, for a business reason. But you must not fight for the wrong side.
[edited spelling]
