> pasting images of seemingly random noise into a sensitive environment is a terrible idea.

Only if your rendering libraries are crap.

I think they mean prompt injection rather than some malformed image to trigger a security bug in the processing library

The LLM is the image processing library in this case so you are both right :)