So I added the following code in the Read ACL for sys_attachment, in the function getAttachmentReadAnswer() just above the 'Remove Prefix' comments.

    //Check HR Case if user created attachment

  if(current.table_name == 'hr_case'){

          if(current.sys_created_by == gs.getUserName() || gs.hasRole('hr_basic')){

                      return true;

          }

        else{

            return false;

          }

  }

Work exactly as expected (hoped).