As it stands, I believe we've already made the changes we can so the behavior you're seeing is the best that can be expected.
In terms of embedded attachments (via [ATTACH]), in emails, we only ever attempt to display the thumbnail URL. Thumbnails are not behind a permission check and should be directly accessible so there shouldn't be any issues with this. We no longer ever attempt to display the full attachment in an email (we did in 2.1), due to the potential for permission issues as mentioned.
Images (via [IMG]) we include as normal because we have no knowledge of potential permission checks; we assume these are publicly accessible files. If you are referencing attachments in tags like this, then they may not display correctly on the forum itself for the same reason. I don't think there's a reason to not include these in emails.
Of course an email client may choose not to display images by default, but that would be a separate issue.
(If you want to change either of these behaviors, there are email templates for bb_code_tag_img/bb_code_tag_attach that control this.)