Making ASP.NET handle requests for static files does not automatically add any security at all, all it does is make ASP.NET serve the file instead of just letting IIS serve it. To actually protect files you would have to implement some custom HttpModule that checks permissions somewhere for the requested file url and decides whether to serve it or not. So you would need to have somewhere to store information about what roles can access what static files and check the current user's roles to decide whether to allow serving the file, just like we check a users roles against page allowed view roles.

Doing this on static content under /Data/Sites/1 would be kind of a bad idea since content uploaded there may be used in pages. While it is technically possible to do it with a custom httpmodule, it would add a lot of overhead to processing requests if you are going to lookup permissions on every file requested.

Best,

Joe