Quoting the latest docs:
For layers in the feature service that can store attachments, the Create or Update operation allows editors of the feature service to add an attachment to a feature. The Update operation further enables editors to update or delete an attachment that is associated with a feature. If only the Delete operation is enabled, editors can delete attachments.
I can't think of a single scenario where the user would be forbidden from deleting a feature, but should be able to delete that feature's attachments. Please align the attachment permissions with the feature permissions so that users must have delete permissions to delete attachments.
