Let me know if there if you come up with any fix. I understand that this is designed behavior and works very well for the back end media library, but it does seem odd to restrict access to the front-end media attachment page since this is viewable by public users that aren’t logged in.
Thanks!