My verdict
You can't have clickjacking on static pages as a valid or pertinent vulnerability, it won't hurt me atleast to skip those headers intentionally on static pages like that of attachments unless it's an API endpoint or so.
Professional Advice
Hell yeah it's the false positive and the sole reason why you are advised to go for bug bounty programs for your company and advised against running automated scanner, not even netsparker which costs a few thousand dollars. If you chose the latter option, do teach yourself the basic skills to understand what's a false positive and that these scanners have much lower precision than manual testing techniques.
No it isn't a vulnerability. Clickjacking by industry standards of the day, requires an attacker to be able to exploit it from the point of view of being able to coerce the user into performing a state-changing action in user's context. Judge the fact by Google's BugHunter university which states clickjacking which can have a state-changing impact on user account is only eligible for their VRP.
What's a valid attack scenario like strictly in technical terms?
So let's say attacker can make the frame hidden beneath a button, now makes unknowing user click on that button and this leads to the user deleting all his data and account. Then yes, it's a valid attack vector and is of P4 priority to an average security engineer like me.
Further clarification
Ask yourself again, can it be used for phishing by an attacker or can he accomplish something useful by embedding an attachment within a frame or iframe, can he record the keystrokes of victim user with the help of embedding the attachment in an iframe? Well the straightforward answer to it is no , not.
Further, you can go and read my article https://dzone.com/articles/looking-at-some-practical-examples-of-security-bug on DZone which was distributed to thousands of developers via weekly digest. It must be a good read for you, just ignore the typos their editorial team made.
