How to ban TL1 or other groups to attach attachments in topics?

There isn’t any at the moment, maybe I’m being too pessimistic. However, as you mentioned, even if it’s a plugin, it can be disabled through safe mode. It seems that the only way to prevent it is through server or S3 bucket settings.