New York City is where "the city field must match the city" goes wrong. The five boroughs hold 311 postal codes between them, and the Postal Service files those codes under 45 different place names. Manhattan is New York. Brooklyn is Brooklyn — 47 codes, and never New York. The Bronx is Bronx, Staten Island is Staten Island, and Queens is not anything: its codes are filed as Jamaica, Flushing, Astoria, Long Island City, Far Rockaway, Bayside, Corona and two dozen more neighbourhood names.
So an address in Queens that says "Queens, NY" is one the Postal Service does not recognise, and an address in Brooklyn that says "New York, NY" is a different kind of wrong — deliverable in practice, incorrect as data. Validation written as an equality check against a canonical city list produces false rejections in the largest city in the country, which is an expensive place to be wrong. California has the same problem arriving from a different direction.
Outside the city, New York State is the opposite problem: 2,154 postal codes spread across 52 three-digit prefixes and 62 counties, from Long Island to the Canadian border. Prefixes 100 through 119 cover the metropolitan area — New Jersey picks up on the other side of the Hudson — and the rest climb upstate, so a fixture set drawn only from 10xxx tests the densest and least representative corner of the state.
The practical rule for a form is to accept the borough name and the neighbourhood name, store what the user typed, and standardise against the postal file only when you are about to print a label or hand the address to a carrier. Rejecting at input is what turns a correct address into a support ticket.