[cpach]

That depends entirely of your threat model. One can’t simply issue a blanket statement that could suit any potential user of Dropbox.

E.g. if a marketing firm would like to send over a company presentation video to a client, perhaps that artifact isn’t sensitive at all. It all depends on the specific circumstances, IMHO.