Hmm, I'll have to disagree on this being a low risk, because there are so many doors that can expose the media on WordPress in an uncontrolled way. It is something that people need to be aware of and treat appropriately.
Personal information can be put in CVs that absolutely should not be made public. There are privacy laws (in the EC) that come down heavily on companies not treating this seriously.
Now, it is great that this plugin is using built-in WordPress functionality (it is one thing that draws me to it as a quality piece of software). I wonder if there are other plugins that can handle privileges within the media section? Or maybe there is a way for Job Manager to specify an alternative upload location? I'll have a dig around myself and see if anything catches my eye.
Yeah, WordPress is a CMS that makes a lot of things easy compared to some other CMSs, but its whole reason for being is for publishing stuff to the world, and so it does lack a certain amount of privilege framework. So it does make some things more difficult to protect and hide. It is not something that should be dismissed though. IMO it does need sorting, but I am at a loss to suggest how to sort it at this stage.