This issue was first reported in #28985.
Any text after the last closing bracket is simply ignored by the request json parser. So for instance a request like:

{
  "query": {
          "term": {
            "ProductID": "one"
          }
  }
},
"field_after_last_bracket": {
}
}

... is accepted.
I don't know why we have this leniency which is why I am opening this issue as a bug.