I didn't clue into this before, but this method is unsafe for public exposure. It will grant access to the thumbnail image without performing a permission check, therefore probably shouldn't be an exported method on the main content API. I think this should come from an internal module. Such as internal/dao.js (doesn't totally make sense to be there) or maybe internal/helper.js (yet a new type of module) or internal/util.js (confusing nomenclature with the public util.js files we have.

I can't think of great places for it, but I think this should really be moved from the public "domain".