Odd behavior with file type field.

I just noticed different authorized behavior on a field I made of type "File".  I put the field in a tab with access level "Registered" ( has to be logged in).

I can upload a Txt format file to the field and when not logged in, I get the correct Not Authorized result.

However if I upload a PDF, the link to the PDF is now accessible by Public (not logged in).

The link to the file looks identical in both cases, so it must be something else:
https://[HOSTNAME]/personal/fieldclass?field=cb_resume&function=download&user=[ID]&reason=profile

I tried all the privacy settings attempting to block the PDF from the public and nothing worked.

PDF are browser cached. You're likely just seeing the browser cache when attempting to access it while logged out. Try accessing the URL from incognito so cache will be ignored. Was unable to confirm using txt, pdf (except when cached), and zip.

Yes, that occurred to me. Maybe some browsers are caching the PDF and not the TXT files. However, the same thing happened on my phone that had never downloaded the PDF. But just now in a different browser, I get a blank page (with template) when it should be returning a Not Authorized result. This other browser has never visited either TXT or PDF, but the PDF gives the blank page while the TXT is the correct Not Authorized page.

It displaying a blank page when access isn't authorized is perfectly normal field fieldclass endpoints. It can either be blank or sometimes an unauthorized error. The PDF however will not actually display and have confirmed as such. So I'm not sure what the issue here is exactly.