If this true, there is possibly a side channel one could run against object storage to determine if someone else in the content-addressable-store has the same files.

Like when it was easy to file share on dropbox by having the correct hashes. A GUID could summon a 1GB file.