> This still allows the attacker to host images on your site though.

Well put.

Probably best to remove allowed hosts altogether.