I have just created two attachments for a book to test-drive how attachments display in the web library. To my satisfaction, not only notes are unavailable, but also the full-text of attachments is unavailable to outsiders when the "don't display notes" option is enabled.
There is some inconsistency in behaviour, as notes are not displayed at all, attachments however are, they are only not downloadable.

This is however not what I wanted to note, but rather a minor, but annoying, confusing issue: the icons chosen for the web library.

I have created the same .txt file once as a stored copy, once as a link.
The stored copy is displayed as a blank sheet (that's ok for a .txt file), however, the linked copy is displayed as a document with a camera in front (snapshot). So actually, when first going to the web library, I was quite confused: due to the icon I thought the one with the camera would be the stored copy.

I recommend changing the linked attachment icon to be — like in the user interface — the one with interlocking chains in front of the document. Ought not to be a hassle.