Any thoughts on how fixable this is?

This shouldn’t be hard to fix. Lemmy needs to proxy images, there’s an open issue for this. Right now, I don’t use Lemmy outside of Tor Browser specifically because of issues like this, and the recent XSS vulnerability is making me even more concerned. Lemmy is a great project, but it needs work and probably a security audit.

For your friends and family, Signal is probably the best. It’s simple to use and set up, unlike SimpleX which some might have trouble with. For people who refuse to switch, iMessage.