They implemented it in a way that it only responds with a valid image and a 200 status code, when the referrer is adobe.com. It's probably somewhat sane given the insanity that is the host files hack.