There is a site setting prevent anons from downloading files that you can flip on for lightweight protection. For heavierweight and much more complex protection server side, see https://meta.discourse.org/t/secure-media-uploads/meta/140017
6 Likes