Unlike Mastodon, Pleroma includes a URL query component in attachment URLs. The URL(lenient:) initializer did not count query parameters (e.g. '?') as valid URL characters and incorrectly escaped them resulting in image requests that 404'd.