They can share the entire nip19 link with they key then they can see it, if they only have the url to the file they won't be able to decrypt it