Make all frappe attachments as private.
You can allow public file for specific doctype by creating an entry inAllow public files
bench get-app https://github.com/shridarpatil/frappe_private_attachments
bench install-app frappe_private_attachments
To allow public files for specific doctype add entry in doctype Allow public files
MIT