It would appear that selecting only “Published” posts in the WordPress exporter means that attachments don’t get exported. Because why should they? It’s not like your posts might use them or anything.