Document that public files are accessible even if shield is active

I expect this is related to web server configuration.

Shield is likely only invoked if the request is served via PHP, may web servers have images being served directly by the web server therefore bypassing shield.

Indeed, the Shield module only locks down requests that Drupal is involved in responding to. That exclude static assets that the web server would serve directly without bootstrapping Drupal. I think this is really an issue of documenting that clearly on the project page.