In my Discourse installation, min trust post images is set to 2. However, I noticed a new user (trust level 0) who has been able to post an image.
I believe it happened because newuser max images parameter overrides min trust post images. I think it should be the opposite.
I set newuser max images to 0 and the issue was solved. Maybe it is not really a bug but only a (potential) conflict in configuration.
Thanks!