This plugin moving attachment file to other protected directory.
/wp-content/uploads/path/to/file -> `/wp-content/uploads/protect/path/to/file`
But, attachment file url is not changed. WordPress will return the attachment file content, check the access permission.