No access restriction on export files

After running the VBO action a message like this is displayed

Export file generated. Click here to download, link will expire in 3 hours.

The linked URL seems to have no access protection - I switched to a new "Private Browsing" window and could still download it. This means that an attacker could access data from a view that is private and protected by permissions.

The issue is mitigated by the fact that the attacker would have to guess the URL. However the URL follows a predictable pattern distinguished by the view name and current minute. The view name could easily be well-known if it comes from a module, so the attacker could attempt to download every minute.

Possible solutions:

1. Apply access restrictions for the download link that copy the access restriction of the view. I haven't checked if this is feasible - of course would need to take into account all the possible access hook mechanisms.
2. Use a non-guessable URL.