There is a small semantic change here, namely that blocks with invalid transaction data (eg duplicate hashes, non-first coinbase, …) will have their headers accepted into the tree (but never considered for connecting).
That’s an inevitable consequence of moving towards headers-first, as we’ll do header connectivity checkinng before transaction checking anyway (the transaction data won’t be available until later, so we rather do more extensive checking on the headers that are available first).
This has very low DoS risk, as it still requires faking PoW.