It would be very helpful if file/image permissions were strictly enforced when in student view or when previewing a quiz. The ability to access a file or load an image should always be based on student-level permissions in order to ensure the student view and quiz preview experiences match what an actual student would observe. The current behavior of Canvas is misleading - unpublished images/files will cache and still load in student view, quiz preview, etc. This is easiest seen by embedding an unpublished image on a published course page or quiz and then switching over to student view.
This is related to ideas: