Images aren’t federated through ActivityPub so I don’t really see how deleting media is supposed to work.

Yes, they are. Every instance downloads everyone’s images for a “cached” version that is currently never used. This is what makes this problem especially insidious and straight up dangerous in cases like CSAM.