I just learned something new: the link that gets auto-generated by the Discourse post editor when you upload an attachment includes a class="attachment" attribute on its a tag. This apparently causes it to get treated as a server-side link and results in it being routed/handled correctly when I left-click on it. That will work in most cases, but it will not work if someone tries to copy the link address and use it in their own forum post.
So, to reproduce this problem, you need to have a forum that serves attachments form the same domain as posts, and you need to have a link without the “attachment” class.