In short no, shopify does not execute arbitrary code you may implement, it’s not like wordpress server etc.
In general: Any “validation” sanitation for form submissions is already handled by shopify.
Beyond that you’d have to implement custom checks in liquid for themes.
Which can be an exercise in futility as you don’t not actually have any control over the form.error properties coming from shopify’s server and liquid is a templating language that does not have things like regex for parsing strings.
If you want to reject orders , without checkout extensions, then you need to do it AFTER the order is placed as a backend process using an app, such as a general automation app like shopify-flow, usemechanic app, or more specific order handling apps on the app store.
About the only workaround do to pseudo validation in the checkout is trying to hack it using the carrier-service api, or setting high prices with discounts that require certain cart.attributes to bring the price down etc.
Or sidestep cart to checkout with draft orders https://tasks.mechanic.dev/create-a-draft-order-from-the-cart