I might have made some sort of progress on this. Looking at:
api.composerBeforeSave
Whose callback is handled in composer.js. From there, we can see that the createPost and editPost methods calls getCookedHtml, which more or less simply returns the innerHTML of:
const editorPreviewNode = document.querySelector(
"#reply-control .d-editor-preview"
);
Which means that if we were to modify this selector, we might be able to force in some HTML that is equivalent to a regular image upload. However, it seems modifying editorPreviewNode.innerHTML does not result in any change at all.
Why is this, or what can I modify in composerBeforeSave to do something similar?