Sounds like it's the former: URLs are guessable/easily enumerable but their contents protected by auth unless they're "published" using the share feature