Publicly accessible PDF folder

Your plugin writes its label PDFs into a publicly accessible uploads folder. While there is a .htaccess with deny from all, everybody aware of the fixed folder name & filename structure can trivially crawl it as far as the server allows.

How can one fix this?