Those settings do not apply to the Shared Files module.
The Shared Files feature is not intended for user specific files nor for files used in html content such as images, it is designed for sharing files by roles and protecting those files so they cannot be downloaded by users who are not in allowed roles. It does this by storing the files on disk with a guid for the name and with the extension .config and the real file name is stored in the database. .config extension is protected so it cannot be downloaded from an url even if you can guess the correct file name and location.
Roles specified under Roles That Can Browse and Upload but only in a user specific location can browse and upload files such as images using the wysiwyg editor (if they also have some edit permissions in content or in forums).
In order for users to have access to the file manager, they also need to be in "Roles that Can Delete Files Using The File Browser in the Editor". This is because the File Manager does allow deleting files so in order to allow use of it the user must be allowed to delete files. Of course they still can only delete file sin the user specific location.
Files in file manager are meant for use in html content and as such they are not protected by a .config extension so if someone knows the url path to the file it can be downloaded, it is not protected in any way.
Hope it helps,
Joe