Are the files content types or fields inside a content type?
They are files content types. But, I can’t find a way to change there access control in order to restrict them only to authenticated users.
You should consider uploading the files as fields in content types. Then you can control who can access what from the interface. Also there are modules to restrict access to specific fields (ex. Field permissions, Content Access)
Also even if you want, you don’t have access to change the permissions of folders under the filesystem.
So to sum up it is better to upload your files in a field inside a content type in order to manage the permissions “the Drupal way”.
Kostas