Let's say a bad node is actively scanning sites. If you have a link to
example.onion/user404/data/page/example123.txt then yes they can see that because you linked to it. Also, if you turn on directory browsing in your web server and the node sees
example.onion/user404 and can browse into those files and subdirectories then yes they could see that.
If you don't link to a file and you don't have a way to browse to a file, then it's very unlikely that someone will find that file.
This all comes down to your responsibility to harden your web server and if you are using a CMS, make sure you keep it patched and follow all security guidelines.
One more thing, and I will use Wordpress as an example because I know it best. I know that somewhere there is probably a example.onion/wp-admin page. I also know that there is a wp-content directory and a wp-config directory, etc. and if you haven't set up your security sufficiently these are all places where I can try to hack you and steal your data. This really has nothing to do with an onion service, but all about being a good webserver admin.