Your params and src are coming from a JSON parse, so doing this automatically feels tricky (to say the least).
I feel like, at a fundamental level, this is asking for the API to “hard attach” an upload to a post and flag it in such a way that it never gets cleaned up.
This kind of opens the floodgates to other issues (where can I see what uploads are hard-attached? What are the limits?).
That said, hard-attaching feels like the only clean way to resolve this.
A hidden link will indeed work as a workaround.
I am shifting this to a feature request because it is working as designed, but the API is not making your life easy here.
I will flag the dev-xp team, who may have more thoughts on this.