Private files openly downloadable

First: thanks so much for making this plugin and making it available for use. Saving me so much time and headache. We’re trying to create a more accessible site for our housing co-operative, and this plugin is so much of what we’re looking for.

ISSUE: This is the same issue as was originally resolved in this thread: https://wordpress.org/support/topic/important-documents-should-be-private-and-they-are-publicly-accessible/

I have exactly the same situation: I set a file’s respective “mdocs post” to private; set the logged in user role to be able to view private posts; set the FILE access to “public”, but UNcheck the “Downloadable by non-members” on the file AND check “Hide all files: Non-members” in settings.

But if I go get the direct link URL to the file, I can pop it into an incognito browser and download the file, bypassing all the restrictions.

Any ideas?

(.htaccess settings are:
Deny from all
Options +Indexes)

Wordpress version: 5.4.2
Mdocs version: 3.10.10
Server compatibility settings all check out in the Mdocs check.

We’re in a Worpdress “multisite” installation – I’m the network admin (I have all the keys). Plugin is activated on a subsite, and all settings are configured on the subsite.