Thanks for your reply!
If the intention is that the media is associated with the post then there is a much bigger “bug”, because as it works right now, you can copy the url to the media (it looks like this https://www.my.domain/secure-media-uploads/meta/original/1X/db86496651c78aa64adbe43b2907654555002.pdf ) and simply share it with anybody who is logged in to Discourse, and they can paste it in their browser address bar (without even opening Discourse) and download the file.