The difference being is that it's not a resource controlled by the attacker, it's an attachment hosted by Signal. But yes, removing previews for everything would mitigate the issue.