It kind of is, though. Google doesn't randomly try to visit every URL on the internet. It follows links. Therefore, for these files to be indexed by Google, they need to be linked to from somewhere.
Good thing, otherwise they would have exposed countless photos via Google Photos.
Today, a photo file might be hosted at:
photos.fife.usercontent.google.com/pw/[snip]=w[####]-h[####]-s-no-gm?authuser=0
But it used to be a little closer to: ...[google_site].com/[superLongAlphanumeric].jpg
And no auth required, URL only!> Therefore, for these files to be indexed by Google, they need to be linked to from somewhere.
So? That’s indeed how Google works.
Google does not work how OP describes it.
I’ve investigated similar incidents in the past on other platforms, it was always user error causing links to be public.
Exactly , that's whyb"non public" github gists work. They are public, but not indexed anywhere "by default "