I have some files that I want to be accessible only to registered users. So I have uploded them to a page set as private. Is this sufficient to prevent unregistered users to download them? I have made a simple test and it seems to me that the answer is: yes, it suffices, but maybe I forget something...
If people can guess the file download urls then they will still be able to get to them (e.g. if someone who has access shares the download urls out).
To get around that kind of problem you typically need to set up a file handler script that will grab them from a protected directory that prohibits direct content downloading and serve them up.
That being said, what you are doing is generally good enough unless it is vitally important that people not be able to find and download things.