It's not that clear-cut. If you enter that 11-code-unit emoji into a field that has maxLength=10, and the browser lets you do so, but the backend system that receives the data only stores 10 code units, you're worse off -- because you probably won't realise your data got corrupted -- than if the browser had prevented you entering/submitting it.