You can fix this bug adding this lines (the bold) in the .htaccess
before the RewriteRule that block the wp-content/uploads:
RewriteCond %{ENV:REDIRECT_STATUS} ^$
RewriteCond %{HTTP_COOKIE} !^.*wordpress_logged_in.*$ [NC]
RewriteRule ^wp-content/uploads(.+) /index.php?wph-throw-404 [END]
and before the RewriteRule that block the wp-content:
RewriteCond %{ENV:REDIRECT_STATUS} ^$
RewriteCond %{HTTP_COOKIE} !^.*wordpress_logged_in.*$ [NC]
RewriteRule ^wp-content/(.+) /index.php?wph-throw-404 [END]