When the Knowledge article is in 'Published' state the attachment button is visible in the instance
System Property - glide.knowman.versioning.minor_edit_fields is the property which is making the fields in the knowledge article to be editable
The attachment button is visible because the two fields [valid_to,author] are editable/writable in the knowledge article even after in the 'Published' state.
So, the OOB Write ACL Sys ID [20cb513cd71221004792a1737e6103dc] will not make the attachment icon in the knowledge article to be invisible for the end users.
Remove both the fields from the value field in the system property - glide.knowman.versioning.minor_edit_fields
Once all the fields in the KB article are read-only the OOB Write ACL make sure that the attachment button to be not visible for the published knowledge articles.