File field download method: public files remain directly reachable after change

Drupal supports two documented download methods for file and image fields: public files served directly by the web server from the public files directory, and private files streamed through Drupal's file download route with entity access checks.

The private file system is enabled via $settings['file_private_path'] in settings.php and is typically placed outside the web root. Download method is a per-field setting. Changing the method later does not rewrite URIs of files already uploaded, so existing public:// files remain directly reachable until migrated. Core does not provide a built-in bulk migration for this.

Access to private files is derived from the entities that reference them and can be altered via file download access hooks. Protection also depends on server configuration when a private directory must reside inside the web root, as .htaccess rules are not honored by all web servers and proxies.

With these constraints, the unresolved decision is how to ensure sensitive uploads are not accidentally public and what to do with files already stored in the public files directory.

Does changing a file field's download method to private automatically restrict existing public:// URIs? What documented behavior governs access checks for private files streamed via Drupal's file download route? How does server configuration affect protection when the private path must reside inside the web root?