lemmy has an image proxy feature, but it doesn't seem to be enabled on lemm.ee currently. it also still has various issues where media may break, it should get better in future lemmy versions (probably only in 1.0, not in 0.19 versions).
some alt uis also have the option to proxy images if enabled by the person hosting it, e.g. tesseract.
there is an open instance available at https://tesseract.dubvee.org/, you can enable media proxying in the settings on the left.
as always with uis hosted by third parties, keep in mind that you need to trust the operator, as they could deliver code that steals your credentials. when possible, use uis hosted by your own instance operator, as they would have access to them anyway if they wanted.
they won't be sent by infosec.pub directly, but other instances may send activities referencing content from infosec.pub, which will lead lemmy.ml to pull it from the source as well.
this includes for example posts and comments in lemmy.world communities, because lemmy.world will announce those to lemmy.ml.