It seems that this condition is wrong, it has to be analyzed a little, but I think the parenthesis is missing
https://github.com/phpbb/phpbb/blob/3.3.x/phpBB/download/file.php#L197
if (!$attachment['in_message'] && !$config['allow_attachments'] || $attachment['in_message'] && !$config['allow_pm_attach']) |