Meh, not that hard to default things to “string”, or similar. For example, the “text” type in PostgreSQL explicitly says “unlimited”, though it seems it’s up to 1Gb. See https://www.postgresql.org/docs/current/datatype-character.html

Similarly, it’s not like text fields on web pages automagically apply limits.

It’s not unimaginable that some dumbass could vibe-code themselves up an easily exploited form.