If the portal user object has failed to load, you might see null. And if the JSON that Runtime gets back from the service is corrupted somehow, then it's technically possible for the username to be null while the JSON was parsed properly. That's clearly an unexpected and highly unlikely edge-case. I myself would not code expecting that.
But in general, I would approach something like this with a guard let statement and/or a precondition.
Something like:
guard let username = user.username else {
preconditionFailure("Username unexpectedly nil")
}
This will help you during testing to isolate any issues. You could also handle the case more gracefully than with a preconditionFailure() if need be.