Stay with 7.19 or hack 7.22 (to avoid the "itok" issue) First things first, I don't need a DDoS prevention mechanism in Drupal since that is my server's job.

In all my Drupal installs, I usually hide the identity of Drupal for security reasons. Image style token (itok) is also a Drupal identifier. I tried a hack to remove itok in 7.22, and found out itok is not a small implementation, which may need more work to get benefit from the community after hack.

I'm just wondering if there is a better way.
No need to hack, just add the following line to your settings.php file:

$conf['image_allow_insecure_derivatives'] = TRUE;    


Source

That will stop the itok parameter from being used.

It's even been wrapped in a module if you don't fancy editing settings.php.

Image Allow Insecure Derivatives


  Provides a user interface to allow Drupal to bypass the token security check when generating image derivatives.


As a side note, trying to hide your site's identity as being a 'Drupal' site is pointless. It's known in the field as 'Security through Obscurity', and it's a waste of resources that could be spent solving real security or performance issues.

See How can I obscure what I am using to run my site? for a more in-depth explanation.