Yea BPS is one of the more stricter and also more secure security plugins out there for Wordpress, I've had various problems in the past with hackers on other sides even with other security plugins so I tend to not try out any different security plugins anymore to be honest.
That said with further testing I've noticed the thumbnail not showing is caused by Cloudflare actually. Whenever their service was paused everything worked fine but if it was turned on the thumbs stopped working.
I indeed assume this has to do with the media queries not being parsed properly with Cloudflare, but why or how this is happening I'm unsure about.
Regarding the data-attribute, as far as I know you don't need to change the main src, this could be pointed to just be the main php file. The additional data attributes like data-width="100%" for example, these could be alongside the src attribute and be used to define certain elements. It's just a thought though, I'm sure this plugin would work for most people if they're not using BPS/Cloudflare :p