> didn’t get why Signal would just download an attachment from an unknown number/contact

Usability, most likely. Ultra-secure and paranoid doesn't result in good UX most of the time.