> it then exposes all of the images to the _app developer_

Not if the app developer proxies the encrypted traffic.

That way the app dev does not know the content and the third party does not know which original IP requested it.

This is akin to the Signal-Giphy implementation.