--validation is refused under --no-allow-remote-refs: its validator resolves the $ref of the document by itself and fetches the URLs that --no-allow-remote-refs blocks.
