Plan is this:
Add a new permission called "upload files to comments" for comment upload module and base access to the file upload field based on that rather than "upload files," so that you can only let trusted users upload files to nodes.
Sounds simple: add hook_perm, hook_form_alter, change an #access property, bing, bang done. Right? WRONG. :) But here's a patch that does that to comment_upload.module: http://drupal.org/node/226858
The problem is that upload.module hard-codes its check for "upload files" in _upload_form(). Here's a patch to fix that: http://drupal.org/node/226853
But the FURTHER problem is, even with this stuff, uploading files still doesn't work. :( The field appears fine, but when you attempt to upload anything it vanishes. I need help tracking down why this is.