Correct. Files uploaded get stored in the wp-content/uploads folder and are public.