It's a shame that OneDrive is such an insecure product by default - as the screenshots in this article demonstrate.
Not sure who thought that the following options are appropriate for 'security by design', but just the names show they aren't.
'Users can share files and folders using links that don't require sign-in' - enabled by default
'Guests must sign in using the same account to which sharing invitations are sent' - disabled by default
'Allow guests to share items they don't own' - enabled by default
'Choose the type of link that's selected by default when users share files and folders in SharePoint and OneDrive - Anyone with the link' - by default
Plus the fact that in Azure AD it's possible for all users, even guests, to invite other guests by default - *facepalm* https://docs.microsoft.com/bs-latn-ba/azure/active-directory/b2b/delegate-invitations