mmmmm... i've tried this both ways with the same result. Uploading a couple of files to provide them as a resource -- i can access them directly after i've closed the browser.
then i followed the above and used the 'files' section of the course to upload the same files -- same result -- can still access them directly after logging off.
checked 'guest access' is off. what's goin' on?!?