I have found the library that is used in this sample code here:
The sample is using the Resource Owner Password Credenatials flow (which is rather not recommended) but that is not the topic of the question. You can see in the related library that at the response the Identity Token is validated with an AssertIdTokenValid() function which is using IdTokenValidator:
private Task AssertIdTokenValid(string idToken, string audience, JwtSignatureAlgorithm algorithm, string clientSecret)
var requirements = new IdTokenRequirements(algorithm, BaseUri.AbsoluteUri, audience, idTokenValidationLeeway);
return idTokenValidator.Assert(requirements, idToken, clientSecret);
So by default the library is validating the Identity token.
The Access Token does not have to be validated in client application (Relying Party). It is only used by this client to authorize against API that the access token will be sent to - like it is when the UserInfo is requested to get the user claims. It is APIs responsibility to validate that access token.
DISCLAIMER: It is recommended to use Authorization Code flow with PKCE in such scenarios.