I have a private organic group with a private organic groups post. I have properly setup my private files system. If an image is uploaded to the private folder an anonymous user can still access it with the following URL:
However they are given a Forbidden: You don't have permission to access this on this server when access the URL this way:
My guess is that Drupal is not doing it's job in the first instance; as I haven't set up private file system properly and Apache is doing it's job in the second URL due to the htaccess file in there.