Steven Zahm@ Michael
re: The robots.txt is just a standard to request search engines etc not to index certain directories, so google etc would comply but this doesn’t change anything in the way of actually accessing the file.
Correct.
re: The .htaccess entries basically prevent any files from being listed in the connections-images folder (and sub-folders I’m assuming?). So this is something enforced by the web server / host right?
Correct.
re: if someone already knew the full URL of the image file, that is not blocked right?
Correct, the URL needs to be publically available in order for it to be displayed by the browser.
re: if someone was determined enough and simply knew a persons firstname/lastname and the directory structure of the plugin they would be able to access the image file
They would also need to know the exact name of the image file. If you use the .htaccess to block directory listing, there would be now way for someone to see the file names so they would not be able to guess the file name unless you name them with names that are easily guessable, like first and last name.
re: Is there any further way around this to restrict these images to be provided to logged in members only or this is a bit difficult?
Upload your images with unguessable file names.
Hope that helps!