Sorry. This one is actually my fault. I was using lemmy-thumbnail-cleaner to remove "thumbnails" prior to v0.19.3 (the version that gave the option to disable Lemmy from making a copy of every picture that federates over).
I felt it was necessary to remove those because it used up a lot of storage space and there might have been files there that I haven't been able to clean out (such as images that copied over from several CSAM attacks in the past).
Everything seemed to be fine until I noticed some recent local images were being removed. Thankfully, it did not remove any older local image. I can restore some of these manually but it will take some time. Everything should be fine now though and any new image shouldn't be removed.
It's not related to disabling iframes. For disabling iframes, I just added a CSP header to disable iframes from other websites except YouTube and Vimeo (I can't think of a better way to fix this TBH). This should prevent weird behavior from other websites downloading files now.
edit: I am going to make a post about all of this and a lot of other info as part of "June 2024 notice" but I'm a bit busy with school right now and other personal matters.