We're working on a managed package that includes two data SObjects which track and log the work the users do in our package. We are including an Admin permission set and a User permission set to manage what user types are allowed to do.
We know that CRUD/FLS checks are important on subscriber objects because we don't otherwise know their security rules. Are CRUD/FLS checks still important on the packaged objects too? Ultimately we're only going to allow our code to run for users whose Permission Set allows the requested operation.