Last time someone was worried about the security it was about knowing filenames of the stuff you host by brute forcing iirc
Knowing (guessing) the file path allows them to access and stream the content. Meaning worst case scenario... Sony (the people known for putting malicious stuff on CDs) can probe your server, and prove the content is there because your server will return the movie file itself.