The export download route /filament-excel/{path} allowed downloading any file without login when the webserver allows ../ in the URL.
/filament-excel/{path}
../
Patched with Version v2.3.3
Thanks to Kevin Pohl for reporting this.