Not really sure what you mean by reusing UUIDs but theres nothing bad about using UUIDs in URLs for content you don't want scrapped by bots. Sites like Google Photos are already are using UUIDs in the URL for the photos, and do not require any authentication to see the image as long as you have the URL. You can try this for yourself and copy the URL of an image and open it in a Private Browsing Window. Every so often someone realizes the actual image URL is public and think they've found a serious issue, but the reason why it isn't is because of the massive key space UUID provides and that it would be infeasible to check every possible URL, even if it's publicly available.

It's not security through obscurity in this case. The filenames can't be obtained or guessed through brute force. At least not with current technology or processing power...

Security through obscurity is when you hide implementation details.

Saying that my suggestion is security through obscurity is the same as telling that ASLR is security through obscurity...

While proper security is better, you're not gonna brute force UUIDs.

Can't be done.