> I didn't think "Anyone with link..." setting promised any kind of security

I think it is reasonable for someone to assume it is a capability, and to be surprised by the cascading vulnerability.