Tell HN: Every photo in Facebook is somewhat publicly accessible

Facebook generates a static url for each photo you upload. Regardless of what your privacy settings are, anyone can access that photo if he knows url of that photo. I don't think that this should be the ideal behaviour? I tried changing my privacy settings such that photos I am tagged in, should be visible to 'only me', but regardless of this, anyone who knows this url can see this photo. I think this is a big privacy leak issue, or am I missing some point ?