> it then exposes all of the images to the _app developer_
Not if the app developer proxies the encrypted traffic.
That way the app dev does not know the content and the third party does not know which original IP requested it.
This is akin to the Signal-Giphy implementation.
[1] Can't find a page specifically detailing it, but [2] gives a basic synopsis on it in the context of allowing GSuite admins to whitelist internal domains from routing through the proxy.
[2] https://support.google.com/a/answer/3299041?hl=en