It sounds like these aren’t still on the device somewhere, but re-downloaded from iCloud.

So presumably the device ID is somehow being used to incorrectly “authenticate” to iCloud and old images are being restored.

This definitely raises some major concerns about how iCloud authentication works.