Yes, it's probably not smart to put anything you want to keep private on Dropbox, unless you encrypt it first.
Now, if it's something you absolutely must keep private, you shouldn't even store it in the private parts of your dropbox folder, but for things where it's not a huge deal if it ends up public, Dropbox is reasonably safe assuming you're not stupid about it (strong password, etc).
If someone can grab the URL to your "recent changes" RSS feed (events.xml), they can watch every file change you make, and view any image you upload, without being logged in to your account.
If anyone from Dropbox wants to correct me on this, or wants more details, my contact info is in my profile.
With a little complaining, I'd bet they'd put up an opt-out option, take out image thumbnails, and hopefully a layer of security over the feed.
Am using TrueCrypt for private data in private folders