The photos are available as publicly accessible jpgs through http. They’re not really trying to do that.

You can't ensure this natively either.