Okay, thanks!!
Yes, I spoke to an add-on dev extensively, and now I understand about the folders and thumbnails. He assured me that as long as attachments are full size, they cannot be directly accessed, and yes, the videos are vulnerable.
Thanks for everyone's replies!