If your post is private, shouldn't the URL to the photo on the file server be as well?

I am hoping you can take a minute to give me your thoughts on this topic.

I'm doing some market research on people's data privacy expectations around their photos, whether or not the photo is on cloud storage or posted on a platform.

4 out of 6 of the popular platforms I tested, the web interfaces required authentication and authorization to private content. Yet, the file store or CDN allows anonymous access, and the URL is not signed. For me, this is a massive oversight if you sell privacy, or you are just hoping someone does not find out. Thankfully, the platforms I have tested strip out sensitive EXIF data, such as GPS data, but there is no guarantee that they will do this in the future.

I'm sure I'm late to the game on this and some security experts are saying "Duh!".