The number type doesn't prevent you typing letters (as you know). It just tells the browser what type of input is expected and it's up to the browser how it handles that. For example, some mobile browsers would show a numeric input instead of the text keyboard.
If you want to enforce number input you need to check what's entered and remove anything that's not a number. Here's one way using regex (although this won't even allow a minus sign or decimal point):
[attachment=0:2rjimvb0][/attachment:2rjimvb0]