I think the guest access token / query variable type access provides a good balance between security and privacy, for example when sharing family photos. I wouldn't want to make my old father deal with logins and passwords, so it's so much easier to provide a link that includes the password. I know that a general visitor to my hubzilla site isn't going to be confronted with my boring family photos, and that these aren't going to end up in a google search.