This module does not restrict access to private files, but only adds another option for accessing private files. This is the idea following from the implementation. In your case, it is better to find another solution.
After installing module the file URL for private file URL is generated with token and expiration. Which is good. But if we remove token and timestamp and try to access the URL, file is still downloaded
Closed: works as designed
1.0
Code
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
This module does not restrict access to private files, but only adds another option for accessing private files. This is the idea following from the implementation. In your case, it is better to find another solution.