I had Microsoft Bingbot somehow "guess" a very specific URL that I only pass around to five people to host ZIP Files. The TLD replies 410/401 on it, no path to the ZIPs.
Then my non-public URL and it's contents got indexed on Bing so I had to password protect the whole thing.