private message attachments are not private

This is by design.

If I have link to the attachment in the first place, whats to stop me from downloading the file and sharing it with others anyway?

Bots wont find attachment unless link to it is posted somewhere.

In 0.40 there is extra permission check fir accessing attachment, but as I’ve said, the feeling of security of attachments on internet forums is a false feeling, so use third party file sharing like google drive for security sensitive files like confidential PDF documents.

Removing this from bugs. If you search this for other forum software, you will get same reply - use forum attachments for memes, pics, or game mods, never for confidential PDFs.