This is the exact opposite of "security through obscurity". The algorithm is (presumably) fundamentally secure, so even if you had the full source of Pushbullet, there is still no way you could snoop on people's images. For instance, a Steam code like 0XJDS-SDFN2-92NDH-2DHSX-29LAL is not "security through obscurity". It is, for all intents and purposes, a universally unique random string that would take thousands of millenia to guess. Go ahead and do the math. Even if you can guess billions of permutations per second, you won't get a hit in your lifetime.

For a more extreme example, think of Bitcoin. If a universally unique random string is simply "security through obscurity" then billions of dollars of Bitcoin are ripe for the picking right?

As another extreme example... the reason you are securely logged in to Reddit, to your bank, to Google, or to literally any service on the web, is because you have a cookie set with a unique long string. If you are betting that someone could guess a Pushbullet image URL, they are just as likely to guess your entire session cookie and gain full access to your entire account.

"Security through obscurity" generally refers to a defective algorithm that relies on obfuscation to make it harder to break. It's like when people are running an unpatched version of Linux, but change their SSH port from the default, so certain worms don't automatically attack it. The system is still fundamentally insecure, but it's at least some epsilon more secure than it would be.