This is a bad approach.

It is a bad approach because gender is not a binary state. (Please get over it.)

"But it's a boolean in the database! A migration would be unthinkable!"

So whatcha gonna tell the state of Oregon when their contract's on the line? How about Canada?

This is worse.

Trans people are not a special case.

"Well, we really just want to know which kind of junk you have."

If you mean to be asking about someone's sex, mind you that it isn't a binary either. The scope of sexual polymorphism in humans is vast and little understood.

You cannot beat this problem with long lists.

Gender is indeterminate.

A person must speak for themselves.

Accept that anything is possible.

"What about attackers with a gigabyte of gender?"

Set a maximum length of a few hundred characters. Who cares? Disk is cheap.