Currently the recording URLS have 0 security, with only link expiry available, they should be secured in some way or at least have the option to be required to be signed into your Retell Account.
The other solution would be to disable the recordings a whole, whilst keeping the transcript on the dashboard.