None of HTML's new form attributes replace server side validation (which is annoying since you end up repeating code and having slight differences), however it's a good start.

With CORS and CSRF tokens, it would cut down on accidental issues – which for most sites is a bigger deal than malicious activity.

In that sense, it'd be a perfect analogue to the "maxlength" attribute on text inputs. (In fact, I wonder if it'd be sufficient to just make that attribute apply to file inputs as well...)

Yeah, exactly. It just prevents people from uploading ridiculously large files which have no hope of completing.