Experimented in greater depth with cPanel:
1) cPanel does appear to block images, except for those used in
WordPress. And not just the uploaded images; logos, theme graphics,
everything --in WordPress -- is unprotected when running LiteSpeed.
(2) cPanel does not forward to the "Redirect request to this URL"
image unless that image is on an unprotected host!
So that means we must: sacrifice a domain to host this image or
leach someone else's image -- both of which are unacceptable.
(3) The cPanel keeps prepending ".*". to the blocked extension list.
It appears to work ok if one remembers to always delete this extra junk
before updating, but it should be fixed.
Conclusion: cPanel "HotLink Protection", in conjunction with a LiteSpeed
server, is unacceptable. The three flaws should be documented or
fixed to save future users from having to rediscover all this the hard way.
I prefer an .htaccess solution, anyway, since it allows different sites
to be tailored and for much finer control of what is and isn't allowed
to be hotlinked.