Well, at least in the tiny part of the IT world I get to control, I always try to validate based on both the three letter extension and any common or sensible expansion of that. So ".jpg" or ".jpeg", ".jxl" or ".jpegxl" etc. etc. (And in most cases, I actually try to parse the binary itself, because you can't trust the extension much anyway.)

"Well, three characters is the bare minimum. If you feel that three characters is enough, then okay. But some people choose to have longer filename extensions, and we encourage that, okay? You do want to express yourself, don't you?"