This is the expected behaviour. Each web application is treated separately for authentication by IIS, and so requires that a user logs into each to be shown the contents of each.
If you are on your internal network, usually the admins set the URLs of the web applications to be in the 'local intranet' zone in IE (other browsers can also be setup in the same way), so when a user logs onto their domain joined machine, their default credentials are passed automatically to each of the web applications as a user accesses them, or components (such as pictures) within them. This process is seamless to the end user, who just sees that they are automatically logged into each SharePoint web application that they use.
Outside the internal network, particularly when not using a domain joined machine, the settings to automatically provide the SharePoint web applications with domain credentials are not in place, or the user account does not marry up with that required to log into SharePoint, so the user has to log in to each web application that they wish to access. In the case that the user only logs into one web application (the main content web application) and then performs a search whose results include elements from another web application that the user has not specifically logged into, they will either be prompted for authentication for elements being brought from the second web application, or those elements are not returned due to the user not being authenticated.