I was a bit surprised by this, given the relative ease of making it more secure.

I've reached out to confirm with them and "recording URLs are long and difficult to guess, so the contents of the recordings should be reasonably private" really is their position.