The current postal code validation is not only disabled by default, but also has very rudimentary Regex rules as default, for example \d{4} for Germany.

To prevent malicious sign-ups, the validation should be improved by shipping better default Regex strings for the post code validation, to ensure that spam sign-ups are at least a bit more restricted.