Yes, that’s true. You could potentially hide videos from anonymous users with CSS, but someone who’s a little savvy could find them so it wouldn’t be particularly secure. You’d need a custom plugin otherwise.
If the filetype is enabled in your settings, videos can be posted directly as you would with images. The full video isn’t loaded for the user until it’s played. For example: