A long standing issue in BigBlueButton related to recordings is that in a stock BBB server the recordings are open to anybody who may have access to the link as can be seen in GitHub Issue#2938

Since since 2015, which is when the issue was originally opened, there have been several API implementations that override that behaviour. That is the case for the API implemented by BN and offered as part of their commercial offering, the API implemented by MConf, and recently (2020) the API implemented by Scalelite as part of the open source.

The BigBlueButtonBN plugin has since 2015 made use of the "protected recording" capability that only allows access to them through Moodle. People who want to have restricted access to their recordings are encouraged to put their BBB servers behind Scalelite or any other Loadbalancer that implement the feature.

But there is a second use case related to this and it is reported as GitHub Issue#5627, where the Teacher (or owner of the recording) should be the only one who access it.

There are plans to implement both in BBB open source in the next version (2.6) in the same way Scalelite does. The first case is already covered, but for the second, the plugin would need to have settings so it only shows the link to the Owner, or Teacher/Administrator when restricted=true