You’ve been able to load remote images forever, that’s how badges work. Yes it’s a privacy issue but it’s worth it because when these backends go down (which they do, often) you get a readme full of broken images.
It’s not a privacy issue because GitHub proxies and caches the images probably since 2016