It should first be noted that Plone out of the box does not assign a workflow chain for Images, so assume we sign simple_publication_workflow. I add an image and use it in a page, where the link with default Large scale is http://localhost:8080/jellyfish.jpg/@@images/98730230-6876-4780-820a-b2ea8d6a4138.jpeg. I believe the 987~ id is a name assigned by PIL for the scale. I then change the workflow state to private. The above now returns a 404. http://localhost:8080/jellyfish.jpg itself is fine and if I view it in the page editor it will happily get a new scaled image for me.
I've tried this with local builds of 5.0.5 and 5.1.4, with my custom eggs removed, and had the same error.
Under the assumption that this had something to do with how scaled images are stored, I looked into plone.namedfile.scaling. I see that it is passing a parameter to AnnotationStorage with the modified time (context._p_mtime) for the sake of invalidating caches. This looks promising - it would make sense that changing workflow might update modified time. I commented out passing in self.modified to test, and that seems to work. I've got http://localhost:8080/ootb/jellyfish.jpg/@@images/27048724-76f9-4476-b3a3-90c7988f5a7e.jpeg and going through several wf state changes that image is still valid.
Frustratingly, I cannot get this to repeat on http://demo.plone.org. The scale id remains sticky and valid through wf changes there. I don't see anything that should be obviously different about that environment. It also doesn't make sense because I can see the modification date has been updated when I change workflow state there.