Attached files are reachable without authentication

[jflat503]

I've just found that the file attached to memos can be downloaded via its URL without user login.
( ex: https://{memos-hostname}/o/r/1/{filename} )

Is it intentional behavior, or did I miss a setting which can block it?