Google Drive creates a proxy link that makes sure that user actually has the proper privileges to access the content, before doing the redirect.

This can be seen by inspecting image link in Google Drive.

I was simply expecting to see the same behavior with Google Photos. As you said, at the very least it would be nice to see a warning, which turns out they provide in some, but not all flows.