I got a different staging server as my #2 result. This is password pretected like OP suggested. https://preview.us.coca-cola.com/products/coca-cola-flavors/...

The link OP shared is open to the public to me. https://staging.us.coca-cola.com/products/coca-cola-energy/c...

I would think that even if these weren't showing up on google that people would be able to find the subdomains through dns. They should probably move these to an internal domain so they are harder to find.