Form upload files can be opened by direct link. Your web server ignores the deny-all file in the private folder. Add this rule to the site's Nginx server block and reload Nginx:

location ^~ /wp-content/uploads/ajem-private/ { deny all; }