Adding this in case I need it again. I was getting comment spam on a WordPress site I took over that was originally built nearly ten years ago. Comments had long been switched off on all post types, but there was a slow drip of comments appearing on media attachment pages through the API, despite having Yoast redirect attachment pages to the media itself.
I was looking for something I could run on the database as going through each media page would have taken far too long. Here is the query:
UPDATE wp_posts SET comment_status = 'closed';
UPDATE wp_posts SET ping_status = 'closed';
As far as I can tell, this has now disabled comments everywhere. It is a nuclear option, so don’t use if you want comments in other places. If you just want to disable comments on media attachment pages you could try the below (I’ve not tried it myself).
UPDATE wp_posts SET comment_status = 'closed' WHERE post_type = 'attachment';