If the URL was unpublished, isn't that the same-ish as password protected?

All about bits of entropy i.e. difficulty if guessing.