So when I copy-paste an image (NOT an image link, the actual image), say, from Facebook, to be included in an e-mail, the last thing I expect is for Thunderbird to paste instead just a link, a link that may not in fact be publicly accessible.

Yet that is precisely what Thunderbird is doing by default.

Fortunately there's a fix. In Thunderbird's advanced settings, we can set mail.compose.attach_http_images to true.

Apparently the location of advanced settings has changed between versions. Currently (version 128.3.1esr) it's under Tools, Settings, [scroll to the bottom], Config Editor...

Why this setting is not true by default, beats me. Who on Earth expects, when pasting an actual image, to have just a link (quite possibly to private/password-protected content) included in the actual sent message? I sure didn't.