Thank you for reaching out about this situation!
ClickUp attachments have private URLs that can be shared by users in your Workspace in order to access files.
To enable easy sharing of attachments via links, this was an intentional design decision (and common practice in software) where we developed a key using randomized sequence of characters in the URL. This makes it impossible to guess. To be clear, the link CANNOT be guessed or found by anyone on the internet without it being shared.
The only way to access these files is if you were shared the link by someone in your Workspace or if someone in your Workspace manually posted this link on the internet.
Still though, we understand that you may want attachments to only be accessible by logging into ClickUp, even though any user can still download and share the file independently.
For this reason, we are allowing users of all plans to disable sharing links that they can share with people outside of ClickUp. Any link generated to an attachment will expire within one hour (with this option enabled).
Please be aware this does result in a degraded user experience, and causes links and attachments to expire every hour, so you won't be able to link to specific attachments anymore.
To enable this setting, please navigate to Security & Permissions and toggle on "Private attachments".
As for the issue of deleted attachments appearing in public share links. I attempted to reproduce this but saw the attachments removed once opened. I've created a video here showing my reproduction steps:
We'll keep an eye out for your reply, have an awesome day!