Changed
Context
Uploaded images can be viewed by anyone, despite using Shield to protect the site.
How to use private files for images, and move existing images?
Analysis
I incorrectly had File FIeld Paths as private://[date:custom:Y]-[date:custom:m]
Resolution
Reset path to [date:custom:Y]-[date:custom:m].
Set Upload destination field property to private.
Use retroactive setting to fix file paths.
Removed anonymous permission to view all media revisions for Photo, which seemed to be related.
Questions