What you’re seeing is correct, and default behaviour.
Each media file has it’s own page URL, as you can see in your first link. As long as that file is in the media library it will be available via that URL. Changing an image in a post won’t change that unless you actually delete that image, not just remove it from it’s associated post. Remember that a post and a media page are two separate things.
Each media file has it’s own page URL
When did this begin to include the post slug? And more importantly, why? If I attach the same image to 1000 posts, I will have 1000 urls of the exact same content?
Why does the attachment URL exist when the post is not attached to any post?
Makes zero sense that this default. Perhaps a valid and clear explanation why would help…
When did this begin to include the post slug?
I haven’t seen that happen before, so it’s a bit new to me. No idea on that one, but it doesn’t have to. Having the post in the URL doesn’t actually mean anything, because of the way that WordPress processes URL’s. As there’s no direct URL that mathces, WordPress guesses the best URL for it, and that correlates to the media page URL.
As for having unique URL’s, maybe, but you should have canonical URL’s set up in your sites <head> area so SE’s know which ones to index.
Why does the attachment URL exist when the post is not attached to any post?
Because media files don’t have to be attached to a post to exist. Every media file in yor library has it’s own page with it’s own URL, and that does not depend on it being attached to a post anywhere.
(Note: I removed the word ‘unique’ above right after I wrote it)
I guess I will need to dig into this more. When I saw the issue, it was the first time I realized that at this point WP would output a url of an image not actually used anywhere in the content of the site. That if an image was uploaded by anyone by mistake, then removed from a post, that it must then also be deleted from the library to not have the image end up showing on a search engine.
I Have not looked at this in some time but my mind tells me that it was always (in the past) that an image not attached to a page or post was never view-able by anyone and that the URL for images was site.com/media-item-slug.
Did that change with the addition of srcset?
As far as I know it’s always been like this – but I’m not a core developer, so I don’t know about the past history of it. From everything that I remember, all media files have always had their own pages and own URL’s, so from my own memory it’s the way it’s always been. But of course if anyone else has any other information I’d also love to hear it.