Isn't discord attachment security really lax? In a "anyone with an image or file link can download it regardless of connection to the server or role" level of lax?

You'd need to be really bold or poorly advised to consider that role