Never mind: I completely removed this block of code (except one line of logging). It's now up to the user / webinterface to make sure the format of unwanted_extension in the ini file are correct: lower case, and with a leading dot. So:

unwanted_extensions = .exe, .bla

Anything else (.EXE or exe) will not lead to detection