This is something I want core to support out of the box, but it would require a fair bit of internal change.
That said, I don’t think the current state of affairs is terrible, the actual links to the assets contain “secure random” strings, they are not guessable.
Sure, if someone with access shares a link to it then someone unauthorized can download.
But…
What if someone with access downloads the paper and then forwards it via email?