I should have said the pihole add on is deprecated.
I’ve not looked at HASS image caching to be honest because it has always just worked for me. Should be easy to whitelist it though. Best in mind live images are likely using the external URL. When you look at the entity in developer tools for live view it should show a second URL which I think is what it uses to save you routing via HASS, whilst for a local image it needs to serve it so it is accessible via the Internet.