Here's a list of (most of) the incoming messages I've seen from (most of) Public Mobile's number(s) on my phone.
https://productioncommunity.publicmobile.ca/t5/Discussions/quot-Public-Mobile-here-quot-numbers/td-p...
I've only received one MMS attach from PM over the years (albeit I received a download placeholder from a previous, failed attempt a few minutes earlier). It was during their holiday gifts "reward" thing. They're not in the habit of sending MMS attachs unless it's something special beyond business-as-usual.
MMS attachments do use active data. They are noted in the Self-Serve data usage as "MMS events" which consume 0.000KB of (the billable) plan data provision.
Pending downloads are actually stored on the Public Mobile (Telus) SMSC hardware - with maximum limits on number, total size, and age - they eventually get deleted or overwritten. They have already been downloaded from the sender's webserver, so unless your SMS/MMS client software actively sends a receipt to the network then there's no way for the sender to know if/when their target has actually received the attachment.
MMS attachments are supposed to only allow image and audio formats but there are certain ways to send executed or executable instructions. These are now old problems (system hacks) with old solutions (software fixes), well known and well implemented. So even a paranoid tinfoil-hat tech weirdo like me doesn't bother yo be concerned about MMS malware attachments from evil spammers.
The CRTC required UNCB (network spam filtering) systems to be in place for all Canadian operators by Dec 2019. Telus (and Koodo, and Public) have conspicuously failed to proudly advertise UNCB features which everyone else brags about, so maybe they're noncompliant and haven't got their anti-spam upgrade in place yet.
