If the urls are guessable then someone could harvest images without having been given urls by authorized users.