Public view link for draft mailing is visible to public before mailing is sent and even before it is complete
It doesn't seem quite right that the mailing is public even when it is in draft state. Of course a bot or interested party would need to be cycling through mailing ids to access it.
It also shows even if the mailing is clearly not complete. For example if the user doesn't select a mailing header before saving the draft then viewing the public page can also result in errors such as Error: Call to a member function headers() on null in civicrm_api3_mailing_preview() (line 597 of /sites/all/modules/civicrm/api/v3/Mailing.php).
To upload designs, you'll need to enable LFS and have admin enable hashed storage. More information