tldr: its possible for images to not really be images. Whenever you are getting user input, its usually best practice to always validate it "server side", in this case, the rust code, which is compiled machine code. An attacker could possibly upload a malicious "image" and if there are rust functions that operate on that data blindly, it could lead to a pwnage (ex. access to memory outside the browser/colorizer program)