The issue is the attribute maxRequestLength is incorrectly placed into system.web node of web.config file instead of httpRuntime node.
I've checked the behavior of the publishing service in Workflow 7.1 SP2 to verify your problem.
You are right - this issue is reproducible.
I've discovered how it works and it seems to be a bug.
When the publishing service adds an Ajax support to web.config file it looks for the httpRuntime node. If it found the node, it tries to move to the useFullyQualifiedRedirectUrl attribute. If this attribute exists, it is set to true. If the attribute doesn't exist, it is added. Then the service goes back to parent node i.e. httpRuntime and tries to move to maxRequestLength attribute and respectively sets it or adds it.
The problem is when the httpRuntime node has no the useFullyQualifiedRedirectUrl attribute at all the service even then goes back to parent node (!) and in such case it will be a system.web node and it adds maxRequestLength attribute exactly to this node!