[gruez]

why not upload the malicious file directly?

[theanomaly]

Because you could bypass filtering / approval mechanisms, or automatic image processing that could defang a malicious image.