Users can see hidden flagged content in the raw url

IMO an important word to add here is

… seeing it accidentally.

If someone goes out of their way to look for it, that’s a different matter.