How do I hide static media file URLs?
As @Clive and @prkos mentioned in comments above, Drupal has different stream wrappers for public and private file systems:
https://www.drupal.org/node/15368
I know you are using Drupal 7, but the Drupal 8 docs on the topic mention:

In Drupal 8, you can no longer set private file system via UI. You set it in your settings.php file.

So you might find it convenient that you can configure this in the Drupal 7 admin UI ( &quot;Private file system path&quot; under admin/config/media/file-system) without any edits to your site's codebase.
If you have configured the private stream wrapper correctly, you can prevent anonymous users from downloading those files and instead respond to their attempts with an HTTP error 403.
The remaining desired functionality is provided by the community-contributed module that @Clive mentioned:
https://www.drupal.org/project/r4032login
The module is available for Drupal 7, 8, and 9. Its project page will explain its usage, but basically it redirects users to the login page when they ask to access a restricted resource, and redirects them to their intended destination once they log in successfully.