None of HTML's new form attributes replace server side validation (which is annoying since you end up repeating code and having slight differences), however it's a good start.
With CORS and CSRF tokens, it would cut down on accidental issues – which for most sites is a bigger deal than malicious activity.
In that sense, it'd be a perfect analogue to the "maxlength" attribute on text inputs. (In fact, I wonder if it'd be sufficient to just make that attribute apply to file inputs as well...)
With CORS and CSRF tokens, it would cut down on accidental issues – which for most sites is a bigger deal than malicious activity.