An authenticated user potentially can view other's Note attachment if the user gets the url.
The entity permission is described in this user doc (https://docs.microsoft.com/en-us/powerapps/maker/portals/configure-notes). But it doesn't seem to explain the permission scope for the attachment associated with the Note record.