Allow Arbitrary Loads = Y required even though all my api are https

When I first wrote this bar code scanning inventory app I was getting object metadata from an http api so I had to set App Transport Security to allow arbitrary loads = yes. The app uses a second api but it is an https api. I have since changed the http api to https and I expected that using two https apis I should be able to turn App Transport Security allow arbitrary loads to No, but when I do the newly secured data api returns data fine, but the original https api used to get an image does not return the image. The image data is a property of the data object coming from the newly secured api. I am using the UIImageView extension below to get the image data.

extension UIImageView{
    func setImageFromURl(stringImageUrl url: String){
        
        if let url = NSURL(string: url) {
            if let data = NSData(contentsOf: url as URL) {
                self.image = UIImage(data: data as Data)
            }
        }
    }
}

The stringImageUrl passed in comes from the imageLarge property on the data object:

imageLarge String "https://get-thumb.herokuapp.com/getThumbLarge.php?objectid=9371"

this how the imageView is called:

DispatchQueue.main.async {
                    self.objectDetails.text = displayText
                    self.imageVW.setImageFromURl(stringImageUrl: anObject.imageLarge)
                }

I am planning on uploading the app to the app store business and I am under the impression that setting allow arbitrary loads to Yes is not allowed for an app store app. Is there a way to get image data from the heroku api in a different way that will work without having allow arbitrary loads = yes?