I always thought it was different, but it appears that if you are not allowed to view a page (because of ACL's), you are allowed to view all attachments to that page. Is that WorksAsDesigned ?
Nope. The attachment visibility should be governed by the visibility of the page which contains them. This is a bug, please file it.
/Janne
