Bot is visiting links that finds on you site. If nothing is heads to these files, it should not be indexed by Google. But for sure you should make some check if user which requests file have permissions for it.
You can configure ACL that only authenticated user can access index action from your controller. But if some files should be public, then check must take place in Controller.