@A3CS Thanks for investigating and posting here. I just had a client contact me with exactly this issue. It must have popped up just as I was rolling it out because it was working for me one day, then I sent it off to the client and it was no longer working.
I actually prefer it to be secured by default, but there does need to be the options of having the folder not secure/accessible if desired.