For simple image types, you can avoid a lot of this machinery by always resizing and converting images serverside, so that attackers simply don't have control over the bits of any image they upload. This used to be the recommended countermeasure back when GIFARs were a thing.

Obviously, a trickier problem when those images are encrypted.