If I follow correctly yes this is an obvious vulnerability. Someone at Google made the wrong decision to not fix this years ago and keeps doubling down on that decision.
If someone does a blog post like “Looking at the first page of 1 billion private Google Docs” they’ll fix it.
If someone does a blog post like “Looking at the first page of 1 billion private Google Docs” they’ll fix it.