You just need to override the unlink method of the ir.attachment object. In the method, check if the logged in user (self._uid) is super admin or not. If it is not super admin, raise the exception.

from odoo import api, fields, models, SUPERUSER_ID
from odoo.exceptions import ValidationError

_inherit = 'ir.attachment'

@api.multi
def unlink(self):
    for rec in self:
        if rec.res_model in ['sale.order', 'purchase.order'] and rec.res_id and self._uid != SUPERUSER_ID:
            raise ValidationError("Sorry, you are not allowed to delete the attachment.")
    return super(IrAttachment, self).unlink() ​   ​    ​   ​     ​   ​    ​   ​