Expiration date validation should occur when you submit the form if you have selected "Validate credit card numbers at checkout." in your CC payment method settings. If this isn't working, I'll dig in... maybe I've screwed up the logic in the function.

If by "bad" you just mean wrong for that card, then I'll look into the code that handles the CC charge on checkout submit. It ought to be halting checkout, but it may be malfunctioning.