Don't forget that there are also dragons if you download and serve those images yourself, just different dragons that might get your own site hacked. See for example how I hacked my own site that was using a Webmention plugin by someone else: https://seblog.nl/2017/02/13/3/how-i-hacked-my-own-site

The IndieWeb loves context, but external content always comes with a risk.