Be default, Refile does not have a way to secure file downloads. It relies on a generated hash that is unknown to users unless the page renders that image or has a download to that file. This is okay sometimes, however, protecting the file from being downloaded for those who have the URL is a bit more involved.
AWS S3 has been a reliable service over the years and for a long time it was the only option. However, in the past few years, there has been more cloud storage options that have popped up with compatible S3 APIs. These services can sometimes offer better pricing and speeds.