Let's say we have workspace default and aaa. We also have a state file called kong.yaml, please see attached kong59954.yaml.
Inside the kong.yaml, _workspace is written as bbb, it is not exist in my kong gateway.

Next I test with below command

Command 1:

$ deck gateway validate kong.yaml
succeeded, even if _workspace is using a not existing workspace in kong.yaml

Command 2:

$ deck gateway validate kong.yaml -w aaa
Warning: Workspace 'aaa' specified via --workspace flag is different from workspace 'bbb' found in state file(s).
succeeded, even if _workspace is using a not existing workspace in kong.yaml

Command 3

$ deck gateway validate kong.yaml -w bbb
Error: workspace doesn't exist: bbb
This is expected, because bbb workspace do not existing.

So the command1 and command2 shows "deck validate" will ignore the _workspace field, which is not expected by customer.

The documentation on the flag when calling deck gateway validate -h has this description for the workspace flag:

validate configuration of a specific workspace (Kong Enterprise only).
This takes precedence over _workspace fields in state files.

This indicates that the _workspace field in the state file should be used if the flag isn’t provided but this doesn’t seem to be the case as Command 1 test shows, the field is instead ignored.