Content-Type is just a suggestion of the data provided to the receiver (consumer). This means that the receiver may or may not take action based on that header.
A typical browser will read the content type header to render the content in the best possible way (JSON as a tree, audio stream as a player, etc.). Try to send a JSON string to a browser with
Content-Type: application/json and without. Same payload received, different presentation.
This is not different from classical application hardening. The golden rule is never trust anything you receive. This includes not only the body of your HTTP query but also the headers.
As a side note, the malicious content can get to your data not only though what you receive and process. Someone can also modify, for instance, the data which is stored in your DB directly in the DB. Thus the absolute need to escape what is sent to the recipient, which is ultimately how XSS (and similar) attacks are performed.