I have tested some configurations for manipulating data with views/vbo and rules and I ran into this:

It is possible to manipulate existing datas by setting an views/vbo and rules/components with an action "Set data value".
For the new value, you can switch between "direct input mode" or "data selection mode" with a given input parameter form field.

If you chose "direct input", it is possible to set one allowed value.
You can clone the component for every allowed value, so you can provide all possible vbo actions in views. This way is ok, if you have only 5 or max 10 different values.

If you chose "data selector", the user have to enter the value, but he has to know, which values are allowed, because it is not possible to provide a select list with all allowed values. There is no validation for the entered value. Every value is stored !!

Example:
There is a content type X with a select list field called "field_letter". In "allowed values" only letters A and B are allowed.
But if you create a rules component with "data selection" in action "Set data value", it is now possible to store other letters, i.e. Z or text. There is no validation !!

The same happens with entity reference fields. You can store any target_id of all existing entities, not only allowed referenceable entities.

Is it a bug ?
or
How to add a validation ?

Would be nice to have a select list form field with only all allowed values instead of an input form field !

If it is not a bug, please mark this post as feature request, Thank You