Admin resources are accessible without being logged in Should the /admin/resources/assetthumbs/{assetid}/200 be accessible without being logged in?

I’ve just noticed I can access thumbnails that way, and with some fiddling even let it generate huge images for me

This is on v2.6.3002.
In Craft 2, this is expected behavior.

In Craft 3, we "fixed" it by using an Asset's UID instead of its ID, which makes it harder to guess.