There is now a plugin available to make images unavailable to non-authenticated users, Discourse Images Guardian, which has been written by @mbcahyono and has been released under the same terms as Discourse (GPLv2):
https://github.com/muhlisbc/discourse-images-guardian
This plugin works by setting a iguard cookie for authenticated users and if this cookie isn’t provided with requests for images a 404 is served. We are very pleased with the quick work @mbcahyono has done on this job and would recommend him for other Discourse plugin programming.