Bad actors figured out how to inject executable code into jpeg files and these would compromise any user who opened the file for viewing. Using a third-party host insulates the forum and user form any excutable code embedded in the picture file. This site will allow uploading of pics directly onto the server formuse in posts. I guess PM code wasn't updated to allow this.