The security is in the fact that you cant just list every single user and all their info. You would need to scrape the info.

A URL with a cryptic file name is theoretically just as secure as a a random password.