Media urls are intended to be used on the client, not the server (as far as I can tell). It’s the client (running in a browser) that will be able to send the session cookie. On the server, you already have the media object, you don’t need to use the URL to get its contents, just use media.get_bytes() (e.g. if the media is a DOCX file and you want to use a Python library to edit the file).
For my part, my bbcode display is happening in the client, so it works well. I generate HTML based on parsing bbcode, and the media url is used in that context (this code could be on the server or client, I’ve done it both places in various iterations of the app):
media_url = data['media'].url
result = '<img src="'+media_url+'"'
The resulting HTML is displayed in an Anvil form (e.g. client side), so is in the session. Any third party usage (which includes any variety of a requests library) doesn’t share the session, so won’t work.
Other tabs in the same browser as the Anvil app do share the same session, so you can safely copy and paste the URL into a separate tab where the Anvil app is running. But HTTP API requests get their own sessions distinct from the Anvil app, so those URLs won’t work when copied into new tabs.