Yes, this is as designed. Both XenForo addons (XenForo Resource Manager and XenForo Media Gallery) also do this. The only requirement is that the viewing user is logged in. This MAY change in XF2, but its not something that I am changing now. Its been that way for 7 years now and not once has it ever been an issue in any of my addons, nor have I ever seen it brought up in 7 years on xf.com in regards to XFMG and XFRM.
Not trying to persuade you to change stuff at this stage, but just so you know:
XF ticket created by me last week Title: [Bug] XFMG not following "Report content" permission Content:
I mean, if you have the "Report content" permission set to "No", members are still able to report gallery content (albums, media, comments, etc.) Answer from Chris:
Yep, that's a good point. That's fixed now too. I saw a conditional in the template, but the variable evaluated there is not doing what I assumed it was.