If you were going to do what you suggested you can just do it with permissions. He's only trying to hide large files that are links. You can't use global template variables in the attachment.html template so you need to add some.
That template is special case because it's parsed before viewtopic_body.html. The inline images are presumably similar to BBcode and it's parsed with topic text. The attachments at end of posts are parsed and held in {postrow.attachment.DISPLAY_ATTACHMENT}, It's already HTML.