Is this a bug?

1. I found an api request that allows me to get the list of assets (in json format) added to a project. The application by default allows any user to view anyone's projects but not their assets and they cannot edit other people project. The assets however only shows the file name, asset type (image/audio), file size and the timestamp. Is this a bug? With the file name, I can easily browse in a new tab in my browser and download it and use it for myself (considering other people project is what they had created themselves).
2. This case is similar to number 1 but this time I don't even have to use the api directly to see other people assets. I found a way how I can view other people assets in their own project. This as well allow me to browse the asset in a new tab and download it for myself.

Would appreciate yous expert hunters opinions. Thanks in advance.