It depends on the level of security sought and the situation. For some applications image security may be overkill. For others the level of security may need to be as extreme as possible.
Most websites are completely open to search spiders and the public generally.
Each page is linked through the hyperlinks and each image has a link to it on a page somewhere. Search spiders and grab type applications use these links to build an inventory. Once someone has that inventory, they can download your images without even visiting the web site. There are two problem areas. One being the image itself once it is downloaded to the visitors browser, and the other being the links from the Internet to that content.