After adding an attachment to a record, if you View/download the attachment the first time the Updated timestamp on the sys_attachment record is updated. This doesn't happen on subsequent views/downloads of the attachment.
Release or Environment
This is expected behavior.
As part of the Madrid release a new feature 'Antivirus Scanning' was added, which scans attachments in the instance for any virus definitions.
Doc link: https://docs.servicenow.com/bundle/madrid-platform-administration/page/administer/security/concept/antivirus-protection.html.
A new column 'state' was added to sys_attachment table which indicates if the file is clean/infected.
On state changes, 'updated and updated_by' are modified. This is expected since a field on that table changes.
PRB1343109 fixes change in 'updated and updated_by' fields on parent record.
Since this is expected behavior, our recommendation is to revisit the customized code that may be affected by this functionality.