Is not it better to pass request object to constructor? This approach does not cover actually what dto is. Passing validated request variables and turn them into dto and passing dto to other service layer classes make security and immutablelity you have mentioned in your article. This is mu opinion and i will be happy to hear yours