I did not fix this particular bug. What I did was show a nicer 404 page (as opposed to blank page) when trying to access an attachment as anon.
Okay, so I believe you have “login required” setting enabled? If yes, an anonymous user can’t view/download that attachment because they are not logged in.