You set up an HTTP server that literally sends people the data when they request it. Don't do that if you don't want people to have the data.
By the same argument I could say: If I send you an exploit and you execute it, don’t complain that your setup fell for it. Just don’t download and run random data from the internet.
In reality there’s a consent and expectation beyond the pure technicals.