SharePoint and OneDrive needs authentication, it doesn't matter the user you share the bot with has access to the pictures, as the bot doesn't authenticate them (unless you require them to do).
My tip is to use a storage space where pictures can be saved and accessed without authentication (eg. website domain storage)
--i tried linking an image from a web storage, and it works. so i guess sharepoint and onedrive links wont work for now, unless microsoft does something about this. alternatively, i read somewhere that you can try an adaptive card to display the image, but i havent tried.