img_auth.php only checks access rights only in non public wikis. the check for public wikis is done by

$publicWiki = in_array( 'read', User::getGroupPermissions( array( '*' ) ), true );

It seems to me that this check does not completely address the conditions NSFileRepo and Lockdown address. Using them it is well possible to have a read access for everyone that is afterwards being reduced by additional restrictions by Lockdown. So it seems to me that this check for public wikis should be changed.

This is ultimately an issue for mediawiki itself but we could make some suggestion from the standpoint of these extensions.