What about users that should see the unpublished files?

Didn't expect visitors so fast. ))

It is a very good point, though in my initial application that wasn't a requirement.

I am working on making it possible. However this module is more oriented towards use cases where you have primarily unauthenticated users accessing the site, and a relatively small group of content managers creating content.

This module is not built to provide fine grained access control.

I’m asking because recently I’ve created this module https://www.drupal.org/project/file_visibility → which tries to solve the same issue

Yeah, I saw your module. I didn't explore it enough, but I thought about using the private filesystem too. Though the idea of moving the original files around doesn't seem appealing to me. Also I want the decision to be made as earlier as possible - not requiring Drupal to be bootstrapped just to hide the file.