I must be jaded, but isn't this obvious? If you don't validate certs you're vulnerable to MITM. If you don't mandate encrpytion on your client, you're vulnerable to downgrade attacks.

It would be nice if the common driver libraries supported key pinning in the connection string.