if you mean u want to protect your public assets something like /public route that if someone sends a request to it it would return an array with all of your media information like the image url this is something you can do and Strapi gives you the ability in the roles and permissions plugin . but i think you want to do something that your user wont be able to download an specific image or video without being authenticated or buying it . well unfortunately that is something you cant do . if there was a way to do that Hollywood would definitely do it. what your users see they can download as well . but if you want to prevent the unauthenticated users from seeing an image well you can lock the route that returns the content type with the image inside it.
let me know if I got it right . and if I did let me know if it was helpful or not <3