If I add an attachment by clicking on the "Attach file to this issue" link, I see the attached screen. At the bottom, there is a drop-down menu for limiting who can see the attachment and comment. Right? Well, it only hides the comment. The attachment is viewable by all users who have permission to view that issue, even if you change the value from "All Users" to a smaller group of users. In the screenshot, the attachment should not be seen by users who are not in the G2 Developers group. But they are.

If attachments cannot be hidden from certain groups, then remove the drop-down menu. But since the drop-down menu exists, I expect it to apply to both the attachments and the comment.