Pages are created for each image
Don't think this is to do with core. Do you have the "File entity" module installed by any chance?

There's a permission of "View files" that anonymous users will have ticked in. If you untick that any of those /files/* will get access denied for annon users