You can create unpublished modules, assignments, quizzes, etc. which aren't visible to student view.  However, if you upload a file to any unpublished module, by default it is published if your Files tab is published.  That seems to be a really bad idea -- something you only put in an unpublished spot is visible in a different spot. This is disastrous for exams.  Yes, there are probably instructions about this behavior somewhere, but it is certainly not what one expects, nor is likely to check for by oneself unless you are a Canvas guru.

It would seem to be a better design to have a default file folder within the Files tab that is called Unpublished which has the default property as an unpublished folder, and that any files that are uploaded into unpublished sections by default go into this folder.  When and if the module/quiz/assignment is published, the file is just moved by default into the Files root, from which it can be moved elsewhere if desired (to other published or unpublished folders).

I would never even have found out about this save for one very honest student. This post is a follow-on to case 05531105