Right now, anyone can pick any attachment from a previous email and attach it to any email using the new Attachment Control, regardless of security role. It would be nice (and probably anyone worried about security would agree) that having these controls behind security roles would be beneficial.