Not appearing on Google does not make a page private
A quote, a test page or an internal document can have a public address even when it does not appear in the menu. Before sharing it, ask what you want to prevent: appearing in a search engine or being opened by anyone. These are different goals and need different controls.
Noindex speaks to the search engine
Google explains that a noindex rule, supplied in a page tag or an HTTP header, tells it not to index the content. To apply it, the crawler must be able to access the resource and read the rule. Blocking crawling in robots.txt can prevent it from seeing that rule.
The rule does not ask a visitor for a password. If the address is public, someone with the link can still open it. Noindex can therefore be an editorial choice, but it does not replace access control.
A hard-to-guess link is still a link
A long address or a page missing from the menu may reduce chance discoveries. Neither defines who has permission. The URL can be copied or forwarded. For a confidential document, the test should not be whether someone can find it, but whether they can open it without authorisation.
Before publishing a file, decide who it is for. For private content, use authentication and permissions suited to the service. Check downloadable files too: protecting the page that links to a file is not enough if the file opens directly without the same control.
Check the two things separately
Open the address in a signed-out session and see what can be read. Then check indexing rules with the search engine’s tools. Do not confuse removal from search results with removal of content from the server.
Google warns that changes to results depend on another crawl and are not immediate. For sensitive data, protect access first. Review indexing afterwards. Keeping these decisions separate avoids treating an SEO setting as a false confidentiality measure.