This shouldn't be true any more, I just tried it out by grabbing the lh[0-9]* url for the image bytes and that won't open in an incognito browser without a Google Login. Can you share with me how to reproduce this "url copy"? If you want to send it privately just tack gmail.com onto my username.
Or you can file feedback from the photo web page and just tag me in it.
You can revoke a link. Go to the shared album page. (clicking on the link will take you there) Click the options menu item and there is a toggle for link sharing that will revoke the magic url and token.