My view is the PKs, FKs, are based on business rules. You can't define an OrderItem to be definitely linked to an Order without a business rule. So if the business rule allows defaults or NULLs for the FK, then it doesn't violate RI.

However, that somehow assumes that the person performing the update really understands the business rules, and has correctly explained this to the business and gotten agreement. That's where I'd be concerned.