When you create a Google Doc in Dropbox, and copy the URL, it's automatically public and anyone with it can edit the file (granted they would need to guess the link). You have to click Share > Settings > Delete link to make it private.
Why is this? Shouldn't it default to private and then you make it public when you want to share it just like in Drive?
I can't see any way to change these default settings either.
I do think it should be private by default as all documentation about Dropbox files point to them being private by default > then make them public. It's nearly on the border of privacy / security in my opinion because it's not clear that this is the case without testing yourself.
I'll go ahead and make the suggestion, at the very least the documentation should be updated.