My opinion is that the most valid separation of concerns in MVC puts the application state in the model -- it's the thing that is valid or not valid.
I get that there are places where you need more specific validation and that can easily go in the controller.
What I can't imagine, and maybe you can help with this, is when you'd need to reuse validation across controllers that doesn't make sense the model?
I absolutely could not understand why Laravel divides things the way it does and I just did not like it. Request classes are a concept that don't even need to exist, and don't, in other frameworks.
When you put validation in the controller, it's not reusable.
Having request classes gives you best of both worlds. I really like the way Laravel does it.
I actually like almost everything the way Laravel does it. Really a lot of thought has went into every design decision.