Why is trusting a file's Content-Type header or extension as proof of what it actually is a security risk?

Both the Content-Type header and the file extension are entirely client-controlled and trivially spoofed — a client can rename a malicious executable to `.jpg` and set any Content-Type it wants. Real validation checks the file's actual byte signature (magic numbers), not just claimed metadata.