Loading an img tag doesn't involve trusting a domain. Especially using crossorigin and refererpolicy attributes.