So? That’s indeed how Google works.
Google does not work how OP describes it.
I’ve investigated similar incidents in the past on other platforms, it was always user error causing links to be public.
“Fiverr might be hosting public HTML somewhere” seems like an entirely reasonable alternative phrase to “these links must be linked from somewhere [that Google can crawl] “, at least to someone who is only superficially familiar with how search works.
The distinction you imply is obvious is not, and your point is thus rather confusing to someone who is not you.
Even still, Fiverr could very well have GDPR/CCPA/etc liability as the host of these files, because they related to its services, it's not just a generic file host.
Indian users, at least that’s what github data suggests.
It’s bizarre UX if you link a file to someone and the link doesn’t work.