Absolutely true. Best practice is to assume your Google Drive is effectively public regardless of permissions. It is very easy for a Drive to get hacked in my experience, not even considering the surveillance from Alphabet.