So... if you have guests on your network or are otherwise connected to a network with lots of people on it, can they just grab all your photos this way?

As of now, yes, but luckily auth support is on my todo list SOON ;)