Hi Oscar,
Welcome to BuddyDev support forums.

The files upload by Xprofile custom field types are public. Please do not treat them as private.

It is still possible to hash/encrypt file name.

Yo may want to try this one

/**
 * Encrypts file name using md5
 *
 * @param array $file file info.
 *
 * @return array
 */
function buddydev_cusotm_encrypt_file_name( $file ) {
	$info = pathinfo( $file['name'] );
	$ext  = empty( $info['extension'] ) ? '' : '.' . $info['extension'];
	$name = basename( $file['name'], $ext );

	$new_file_name = md5( $name );
	// limit file name to 12 characters. comment if you don't want to limit.
	$new_file_name = substr( $new_file_name, 0, 12 );
	// update file name.
	$file['name'] = $new_file_name . $ext;

	return $file;
}

add_filter( 'wp_handle_upload_prefilter', 'buddydev_cusotm_encrypt_file_name' );

Please do note that it will encrypt the file name for all files uploaded via WordPress and not just ours. In next release, I will put an extra hook to allow us to it selectively.

Regards
Brajesh

Thank you Oscar.
Please do let me know if it worked or not?

Regards
Brajesh