When a media does not have any restriction applied, it defaults to the general account restrictions. If the account is configured so that users outside the account cannot access the content, media with no manually applied restriction will take this type of restriction by default.