I believe that DTOs should only be used in the controller layer, while services should work directly with models to maintain the independence of business logic. Imagine if your request didn’t come through HTTP but via gRPC or a message queue; you would only need to map it to the corresponding model, and the service code would remain unchanged