Curious, did you perform these tests on a standard account or did you do this from an operator account with a standard membership profile?
Yes, this matters. Hence why I'm asking.
When I write 'public' it means you don't even have to be logged in, you're anonymous but you have access in the search results of secret spaces, and secret content names, try it yourself to see.