Although the Resources tool is hidden, any student that is enrolled at a site can have access to the full list of resources easily via WebDav knowing the id of the site.

Maybe this is not a bug but, at least in our University, when instructors upload resources and hide the Resources tool they think there is no way for students to access to all the resources but only the ones they include in other tools (or share via web link).

When the tool is locked students can't access to the resources in any way.

We think there is a need to study this issue. In our opinion, the behaviour of WebDav should be the same as the web interface one: if the tool is hidden students should not have access to the list of resources via WebDav.