You’re right, I think it is reasonable to only update ACL when the upload needs to be marked as secure. This should fix it: FIX: Only trigger upload ACL update when needed · discourse/discourse@5c5d8a3 · GitHub
Note though @hosna the fix only applies to uploads when creating a new post. There are other operations that trigger an ACL update on the upload (for example, converting topics) and those will probably be still broken using Minio.