[boysabr3]

I think this is a fairly standard practice. This is exactly how shared links on Dropbox, Box, Mega, Imgur, etc. work. You can think of the URL as one long, and extremely hard to guess password.

Completely agree that Google Photos (and the other data hosting services) could provide warnings to those new to this method of sharing — I wouldn't expect my grandma to simply know this.

[akras14]

Google Drive creates a proxy link that makes sure that user actually has the proper privileges to access the content, before doing the redirect.

This can be seen by inspecting image link in Google Drive.

I was simply expecting to see the same behavior with Google Photos. As you said, at the very least it would be nice to see a warning, which turns out they provide in some, but not all flows.