Is saying “JSON Object” redundant

There are many libraries that will help you serializing and deserializing your data in XML or JSON. CSV is not so popular anymore, so you may need to do everything yourself. On top of that, both XML and JSON are probably easier to read for a human, which makes debugging easier and faster (i.e. cheaper).

CSV, on the other hand, has less characters for the same data so it takes less disk space and/or bandwidth.

Usually developer time (i.e. costs) is a much bigger constraint than disk space or bandwidth use, so most people will use XML or JSON. Using one or the other is a matter of which libraries you are most familiar with or even cultural reasons (Java and Scala people tend to use XML, Javascript people tend to use JSON). XML is more verbose (i.e. more disk, more bandwidth), but not to the point of being a problem in most modern projects.

If your boss is quite old, maybe he remembers the days when it made a difference to send data over the wire in a plain compact format (like CSV, or even an ad-hoc binary format) instead of XML, but that is very rarely an issue with modern computers and modern networks.

JSON representation can be dense, certainly denser than a flat list of properties, so memory exhaustion and denial of service may be slightly easier.

Other than that, assuming your JSON parser is bulletproof, you're left with basically the same attacks that can be directed at a form-data or query-string based entry point, primarily various kinds of string injection attacks: SQL injection, client JavaScript injection, and so forth.