I have always accessed the wordpress installation via https. I’m the web-host, the system is Linux with stock ISPconfig 3.1
I have tried changing the pictures now, it saves them as https. Seems to have been fixed by some update, sorry I did not check with latest version.