Yeah this was pretty much my reaction, and seeing that it's not supported (either by Immich or Photoprism) really made me think these projects are not for me.

Photoprism shouldn't be in consideration at all. They felt the need to post in their FAQ that not checking authorization/authentication before serving photos* if directly linked is OK because its "industry standard" and (paraphrased) "difficult/impossible to implement"

* might just be thumbnails. But lets be honest- a 1/10 scale thumbnail of 40MP shot is... still a ton of detail.