I agree with the “order of magnitude” text size limit. I tend to put 10x of what I would consider the expected average. A bit like cryptographers put 2x the number of rounds they think may be eventually broken.

Why should the database be the input sanitizer, though? Intermediary systems can break or degrade before it reaches PostgreSQL.