Hey gazumped,
Thanks for taking a dive in to this topic! I appreciate the help.
I actually had a similar theory and to test it out I configured Zapier to do the same thing. Zapier is not enabling the PublicURL of the notes. I've tried to dig in to the Zapier Zap to see if they're using the PublicURL and then turning it off, but I can't find anything to prove that.
Do you happen to know if there's somewhere to see the API calls to my Evernote account? Maybe I can see there what IFTTT is doing compared to Zapier.
I did contact Evernote support and they said it's up to IFTTT to handle the service. Trying to get a hold of IFTTT support is much harder.
I do know it'd be pretty difficult for someone to find the PublicURL of a note once enabled, but no matter how minuscule it is a security risk in my opinion.
Cheers.