Direct Link Still Works When Member Only Checked

Hello. I’m testing this plugin to see if it’s a fit for a client project. I need some downloads to be completely unavailable to non-logged in users. After uploading a test PDF and checking “Members Only” I notice that I can still access the PDF (in a separate browser, not logged in) by visiting the direct link. For example:

/wp-content/uploads/dlm_uploads/2017/05/Test-PDF-for-Secure-Download.pdf

The knowledge base says this folder is protected by default, but in my case it doesn’t seem to be protected.

I’m testing this on WPEngine.

Are there any extra steps that need to be taken to lock down the dlm_uploads directory so that files are truly inaccessible to non logged in users?

Thanks.