Call admins now have the ability to restrict which types of files are allowed for uploads.
The new setting is in two places: the form builder and the Publishing Module. In both cases it is a safelist (as opposed to a blocklist) meaning authors are only allowed to upload files with extensions you specify. Or put another way, authors are prohibited from uploading files not in the list.