Because of the nature of Nginx redirect rules, the requested physical file is redirected as aam-media query param.

AAM expects the requested file in REQUEST_URI and does not know how to handle NGINX specific redirects. That is why any files that are protected with URI Access service can be read.