iCloud allows access to files via direct link without authentication!
I filed a bug report.
Them:

Can you please set up such a file (not shared) and then send us the link so that we can confirm we are able to access it despite your intent not to share?
Thanks,

Me: Here's the link.
Me, later: The link shows &quot;gone&quot; after some time. Here's another.
Them:

This is by design. The link URL will expire.
Thank you for your feedback.