If the Forms process is set to public, then anyone with the URL to that process can fill out the form and submit. That includes attaching files to an upload field. Public users are not able to participate in anything past the initial submission without an account.