That is false.
Random mode is just a redirection and to view anything in /image/<id> you need to have permission. If the image is under an album with the permission "anyone with the link" or the website privacy is forced the content will be under that privacy. When you select "private" mode then you use default content privacy all the content who isn't under a privacy permission will be visible. That is why you can force the website content privacy so you can have a private website and force all the content to be private.
This code in route.image.php proves that:
PHP:
// Privacy
if($handler::$cond['forced_private']) {
$image['album']['privacy'] = CHV\get_chv_setting('website_content_privacy_mode');
}
if(!$is_admin and in_array($image['album']['privacy'], array('private', 'custom')) and !$is_owner) {
return $handler->issue404();
}