I think we still need to 404 here. This branch is hit if an editor who isn't in the correct organisation tries to access the asset, so a 403 is still leaking the fact that the document exists.