Similarly uncommonly known: All Dropbox Paper documents are publicly accessible by anyone with the URL by default. There's no way to change the default either. I get the improbability of someone guessing a URL with a long hash but if they obtain it any other way, such as from the HTTP request or browser history, other people still have full access to your docs.