You can revoke sharing links, but there are also direct links to photos that work for unauthenticated clients. They aren't presented in the UI as a sharing option; you have to use your browser to copy the link. In other words the only way to make these links public is through intentional user action.