Let's be more specific about the protocol, because ‘Diffie–Hellman’ can mean a lot of things including just an abelian group action on a set.
Suppose there is a set of users including Alice and Bob. Suppose each user has a public key known to everyone to be correct, by, e.g., being published in the telephone book. (This is the original setting of Diffie and Hellman's seminal paper, and is also essentially the setting of DNSCurve, probably the first application of X25519.)
When Alice wants to send a message to Bob, she looks up Bob's public key $x_0(B)$ in the telephone book, and computes $k = H(x_0([a]B))$ from $x_0(B)$ and her secret scalar $a$, where $H$ is the standard hash function. Then she uses $k$ as the secret key for symmetric-key authenticated encryption. When Bob receives a message from Alice, he decrypts it with $k = H(x_0([b]A))$, where $A$ is Alice's public key in the telephone book.
Only a self-destructive idiot would fail to follow the protocol and put a public key generated any way other than the standard method of picking $n$, an integer multiple of 8 between $2^{254}$ and $2^{255}$, uniformly at random, and publishing $A = [n]P$ where $P$ is the standard base point. Such a self-destructive idiot could also publish every message sent to them on reddit. So there's no sense in worrying about a user failing to follow the protocol for key generation, except maybe as a public health service scanning the telephone book for mistakes.
What if we don't assume a legitimate telephone book? Then we get into the territory of authenticated Diffie–Hellman key agreement protocols. The details are more than fit in the margin of this crypto.se post, but suffice it to say that if an adversary can substitute a point of low order, and your putative authenticated DH protocol doesn't detect that, you probably have bigger problems on your hands.
In the bizarre case that you manage not to have bigger problems on your hands, but you still need both parties to substantively affect the outcome of the key agreement even if one of them is malicious, you are probably better off using $H(A, B, x_0([a]B)) = H(A, B, x_0([b]A))$ as your shared secret—and, generally, you should hash the entire transcript leading up to the key agreement into it so that a meddler on the wire can't futz with any bits of the exchange without changing the resulting key.
Note that this answer is limited to X25519. The X25519 function was designed so that every possible encoded public key bit string is safe to use with every legitimate secret scalar, even if what it encodes is an illegitimate public key—i.e., not $[8n]P$ for some 251-bit integer $n$ where $P$ is the standard base point.
If an unwary user reveals $H([n]Q)$ where $Q$ is an adversary-supplied point of order 8, then since there are only at most eight possible outputs, an adversary can learn $n \bmod 8$—this is the Lim–Lee active small-subgroup attack. But since legitimate secrets in X25519 are all multiples of 8, all the adversary learns is that $n \bmod 8 = 0$ per the protocol.
Not all curves or DH functions have this property: curves with cofactor >1 used with secrets that are not multiples of the cofactor, or DH functions and protocols without point compression (like many archaic protocols using generic Weierstrass curves and no point compression), may cause unwitting implementations to leak bits of the secret if they don't reject invalid points.
The considerations for Ed25519 signatures are a little different, and addressed elsewhere (1), (2).
