The Drupal nignx configuration blocks loading of all *.txt and *.md files to hide some of the Drupal core files like CHANGELOG.txt. There is an exception for allowing these files from the public filesystem directory (sites/default/files) since those would be files added dynamically (like on a field field) and should not be blocked.

It looks like there is no exception for the private files directory though. In Drupal all private files are loaded through a Drupal handler with the url system/files/* and this is not included in the exception. Since private files are also added dynamically (like on a field field), these should not be blocked by nginx config either.

Relevant part of the config:

## Do not allow access to .txt and .md unless inside sites/*/files/
location ~* ^(?!.+sites\/.+\/files\/).+\.(txt|md)$ {
  deny all;
  access_log off;
  log_not_found off;
}