could `Sec-Fetch-Dest: image` mitigate this?