This was a known issue for past versions of Moment.js: YYYY-MM-DD with 3 digit year returns true for isValid().
It was fixed in December 2013, and your code works as expected with the most recent version of the library. Version 2.3.1 was released in October 2013 and does not include this fix.