An attachment's state depends on its visibility

There was an invalid assumption that all attachments could be considered
'published', whereas they are only accessible if the thing to which they are
attached is accessible.