The fact is that what you've just described only works on older versions of the game (before 2012). Usually, more modern versions (such as 2016) have trust check protection, which can be bypassed, but it introduces new issues and significant vulnerabilities in the game client's network code, allowing even a seemingly harmless image from the internet to inject malicious scripts into the game server. (really, i am checked)
Viewing post in Add roblox cookies
You have a point, but wouldn't it be possible to try and make it so that if the client detects that an image or audio is trying to load malicious code, the client refuses to load the link? I know it's a bit complicated. Also, I have to tell you something important. If the user ends up being affected because malicious code from an image was executed, then the USER is responsible of his actions, not you. Because the USER decides which servers to join and also decides which assets to load in their game.