But a normal developer still can allow users to have email on TLD with more than 4 letters anyway. Thank's God a webpage unless an app does not forbid to look at the code full of fancy regexps.

It reminds me a situation when I could not register a bank account and nobody could help me, even the official support. There was (maybe even still is) an issue when the webpage tells me that my password must contain 4 digits but it did not tell that that digits must be in one chunk (abcd1234 or a1234bcd but not a1b234cd). Several friends of mine had to show me their passwords until I realized that their digits are not sparse.