Is using a GUID for an uploaded filename secure?

Intended share !== unintended leak. If you use public links, you can guarantee nothing at all. And you will create wrong illusion of safety.

The most obvious sample - when you distribute notifications, you can not be sure, that nobody scan content and do something with links if those are public.