It seems that Arne has confirmed in a different thread that input and output buffers can be the same: [Solved] FX plugin wrapped for VST2 receives its audio input in the output buffer - #4 by Arne_Scheffler
It looks like JUCE checks for this as well: JUCE/juce_VST3_Wrapper.cpp at 90e8da0cfb54ac593cdbed74c3d0c9b09bad3a9f · juce-framework/JUCE · GitHub
It would certainly be nice if this were mentioned somewhere in the VST3 documentation.