They're sort of correct. Let me explain.
In Dropbox, there are two ways to share files. Sharing a link to a file from any folder will generate a link in the following form:
https://www.dropbox.com/s/randomkey/filename Anyone can access the file you posted with that link. However, each time a file is shared like that, a new random key is generated and associated with that file. Other files cannot be accessed using that key.
However, there is also the "Public" folder in Dropbox. Files shared from this folder generates links differently, in the form:
https://dl.dropboxusercontent.com/u/userid/filename In this form, any file from your public folder can be accessed, because your user ID will not change. Someone would have to know the filename of what they're retrieving if they're accessing a file you did provide a link to, but it is a public folder.
Thus, they're sort of correct, but it's not really a security flaw because you're declaring the files as public anyways. No files are public unless you place them in your public folder, declaring them as so.