I have a customer community and added a visualforce page to the community by going to Sites then Site Visualforce Pages. I am able to invoke the VF page by directly going to CommunityURL/vfpage and I was surprised with this behavior and I thought Salesforce would redirect the user to login page but It did not and able to access the page without authentication.
Just to give more info, If I go to CommunityURL and it would redirect me to login page but If I open VFpage directly , no login is required.
I also tested this by opening the browser in incognito mode just to make sure my login is not cached but same behavior.
Can you please give me some insight why this is happening?