Before replaying a backup on a production system, you would need a pre-production setup where the backup is replayed and checked. Honestly, you can only be sure that a backup is working correctly after reusing it. You could always do some validation of the raw backup contents, but you need at the end the WAL applied on top of it to be able to check the status of a server that has reached a consistent point.
Could you elaborate a bit more on this last part? If a PostgreSQL recovery from a pg_basebackup reaches a consistent point and is able to start up fully, that is not a guarantee that there hasn't been any underlying corruption, as far as I know. Am I correct on this?