One of the issues that presented itself with the changes to the way groups work in Zap is that it is difficult/cumbersome to attach files to group posts. I've given this a lot of thought and decided to provide group members with write_storage (file upload) permission. This way they can attach files to group posts, though the files will end belonging to the group. They won't show up in the person's own file repository. This sort of combines groups/forums with the "repository" permission role which Hubzilla has.
It also seemed prudent to remove this permission when the poster is being moderated. As always, you can add or take away either permission from any individual connection but this should provide sane defaults and the group owner (and moderators) can also remove any file for any reason.
I don't see too much to worry about here except when it comes to resource limits, as these file uploads will belong to the group. Service class limits still apply, but the entire group will be prevented from further uploads once a limit is reached. I'm inclined to leave it for now and cross that bridge when we come to it.