Pretty much... more along the lines of that users should only interact with specified UI. Hashing filenames abstracts the media (files) from the user, leaving the application to deal with managing said media.

E.g. If Facebook were to store profile pictures as the users' name, people would be able to access images based on altering a URL. The HTTP protocol (most likely) wont know if the current user entering the URL has "permissions" or "is a friend of" the picture it is requesting from the server...