Regarding plutus-apps Auction use-case plutus-use-cases/src/Plutus/Contracts/Auction.hs , both auctionSeller and auctionBuyer need to specify the same exact params, or else each buyer could change the auction deadline! What exactly stops the buyer contract from doing so?
In a way, you are (but aren't) correct since auctionSeller and auctionBuyer could be used to arbitrarily declare params. However, these functions don't run on-chain, they are client-side code for preparing the structure to be submitted for placing a bid.
The on-chain validation is in the "auctionTransition" function which accepts the bid, or payout. Both these inputs don't even accept a deadline or token type value so it isn't possible for them to change the state in that way. Otherwise, the token and deadline are immutable, so they cannot be changed.