This is a privacy & security issue for all attachment in ClickUp.
After you delete the attachment from task, the attachment has been removed and not visible in the task but the attachment is still accessible if you open the link with your browser. After you delete the attachment, it is still publicly accessible by anyone if they have the url.
This means anything that you uploaded to ClickUp will remain stored in ClikUp server indefinitely even after you remove it from task. And the file is accessible by anyone if they have the link.