But without authentication, there's no way to know if the people who claim to be the people one shared the link with to be the people one actually shared the link with.

Whole-document transformation and copying are a concern, but I think that's usually treated as a different category of issue from "The server I trust to store the data securely gave it up to some anonymous person who passed a correctly-formatted request to it because the server can't know any better."