Per documentation, when adding attachment during ticket creation on web, the attachment is 'Private', but on Mobile it is sent to customer.

Inside the ticket once opened via Web, there's no indication that the attachment is private (ie: not marked black/lock-icon) so it's not obvious to the Advisor