It reminds me of the old way Chrome didn't hide saved passwords. It made sense under the threat model they had for the feature, but it wasn't the security model end users expected would be the default.

A simple UI fix would be to explicitly call the sharing mode "unlisted" like some other sites do including Youtube, with a similar warning about linking to the content.