In reply to Brad Touesnard.

Hey Brad, thanks for following up!

2. We add a salt to the default filename making it hard to guess

The salt is a 5-character long alpha-numeric string. If the web server is configured correctly, it'll probably ignore case, so that's a bit over 6M possibilities, which in bruteforce language is peanuts. If, however, the web server is configured incorrectly, it can spit out a directory index when accessing the uploads directory, making it even easier.

The chances that PHP has write permission to the uploads folder is very good, so that’s why a lot of plugins use that location.

Plugins should stop assuming anything has any permissions and use WP_Filesystem instead :)

How do you detect a non-public folder?

I'm not sure, perhaps you can try sys_get_temp_dir().