What is the difference between a hard to guess password and a hard-to-guess URL?
Of course, that "someone" could also just take a screenshot or copy the image.