That’s why I password protect any one-time URLs that I ever use, regardless of the provider.

They can’t cause the URL to auto-expire if they don’t have the password.

This password on the one-time URL is something that I share via less secure methods and is easily guessable. It’s only purpose is to prevent the one-time URL from being auto-expired by malware checkers or preview creators.