Hmmm, in my mind, the ideal goes something like this:

* when uploading the file from update.bml in the middle of making an entry, you have the option to make it match the entry security, or be an image-specific security setting. Default is to match the current entry security

** for draft posts and until such time as you post the entry, the newly uploaded image shall be private, because you haven't specified what the entry security should be. Once you have posted the entry, the image security shall match the option you chose above.

** once you've posted the entry, editing its security won't edit the image security (I suspect it would be too complicated otherwise -- but I could be wrong!)


* when adding an already uploaded image -- say you're on update.bml, and we have some kind of image browser for your gallery, the entry security doesn't affect the image security

** said image browser could, potentially, link you to a page to manage your images/an image, so you could still easily edit the security or whatnot, on the fly, before using it in your entry