Did you find a solution for this? I have the same kind of problem. I have images in a field in a data type and the privacy rules that only allow logged in users to see, but for some reason the image allows the link to be viewed even if you are not logged in.
