I think we're talking past each other. There's no uncertainty about how DNSSEC works between servers. Any recursive lookup can validate a signature chain.
The question is how DNSSEC breaks down in the last mile, where recursive lookups aren't happening. A stub resolver --- every resolver on an ordinary workstation is a stub resolver --- can absolutely be tricked by its upstream DNS server. Quad9 can lie to clients about whether it validated DNSSEC, or whether DNSSEC was present at all.
The question is how DNSSEC breaks down in the last mile, where recursive lookups aren't happening. A stub resolver --- every resolver on an ordinary workstation is a stub resolver --- can absolutely be tricked by its upstream DNS server. Quad9 can lie to clients about whether it validated DNSSEC, or whether DNSSEC was present at all.