1. Add to home page a file resource.
2. Link a pdf, save and hide the resource.
3. Let's suppose that the course module URL is https://moodle/mod/resource/view.php?id=6
4. Now go to Home ▶︎ Site administration ▶︎ Privacy and policies ▶︎ Policy settings
and set Site policy URL to https://moodle/mod/resource/view.php?id=6
5. Save.
6. Now open again the setting page of the file resource in the browser and leave it open.
7. With a different browser log in as different user expecting to see the file.
8. Change the appearance in the page opened at point 6 and run again point 7.

By changing the setting in the page opened in point 6, the outcome may get a really unexpected shape.
Setting appearance to "automatic" I get an iframe showing the page having the same iframe showing an endless recursive disaster in Mac Safari;
Setting appearance to "In pop-up" I get, from a windows client, the attached screenshot.
From mac google chrome the outcome is different again.