Option 3

Reasoning:

• Upside 2: 100% best for lemm.ee health; lowest legal risk, lower cost to run.
• Downside 1: I think it comes down to what lemm.ee is trying to provide as a user experience; in my use and expectation, it’s not for masking my IP, making me anonymous or similar. It’s for reading and interacting with people, looking at memes and reading lots of news stories. I have no expectation my IP is masked from remote sites - I open all external news links in a Private tab anyways (to stop cookies and other junk) so they’re already getting my IP anyway. “why should images be any different, really?” There are other lemmy instances out there catering to extreme privacy.
• Downside 2: this could be, should be, whatever handles by better page loading threading in the code; the content surrounding an image is just HTML, the load of the image is a secondary task. If the rendering of the view of the page is reliant upon 200 OK image loads, that feels like a deficiency in design and it needs to be async threaded to “lazy load” and not block.

At a high level, many other solutions - Mastodon, even Nostr webapps and phone apps which is all about being anonymous for some folks - do direct content load from the source and do not proxy loading. The switch back to option 3 falls in line with what every other generic service/solution does in the social web space.