Short answer
HubSpot's KB: who sees an attachment depends on how it was added. On notes and tasks, users with Their-level access only see their own uploads. Detach removes it from the record but keeps it in the files tool.
1. In HubSpot
The relevant screen in my demo portal.

2. Worth knowing
Don't store sensitive files in the files tool.
3. Related
Attaching files by API and record access.