If the Files application has "Can View" set to Public, the default permission for individual files should also be set to Public. Currently, if you go to https://phabricator.wikimedia.org/file/upload/ the default is "All Users". Many people will probably not notice this, or think "All Users" means "everyone", leaving files with the wrong permissions.
See https://phabricator.wikimedia.org/T1248 .