`m.room.power_levels` provide no way of restricting the media (via mixins) you can embed into events.

[Gnuxie]

A security/potential problem that was missed in matrix-org/matrix-spec-proposals#1767 (comment).

m.room.message doesn't let you do this either, and that's why Mjolnir has protections for removing voice messages and other media automatically.