“Downloading image causes outbound http requests against arbitrary endpoints”

Pair this with a zero-day in the HTTP request library and an image becomes the initiation of an attack that leads to a vulnerable client connecting to a malicious endpoint.

Could also easily be used to track users in new ways.

Just two scenarios that immediately comes to mind.