The Autodesk View & Data API (developer.autodesk.com) allows you to display a DWG on your website using a zero-client (WebGL) viewer. You need to upload the DWG to the Autodesk server, translate it, and either then download the translation to store on your local server (as demonstrated on extract.autodesk.io) or keep it on the Autodesk server. You might consider downloading it to be advantageous because then you don't need to implement the OAuth code on your server.
Buckets on the Autodesk server can only be accessed using the accesstoken created from your API keys, so it is secure in that only someone with your accesstoken and who knows the URN can access your translated file. However, for the viewer on your client-page to access the file, you need to provide it with your accesstoken. This does mean that someone could separately access your translated file by grabbing the accesstoken and URN from your webpage. But if you're serving up the model on a public page, then you presumably don't care about that.
There is a 'list' API available, but this is white-listed (available on request), so getting your accesstoken and urn for one file doesn't automatically give access to your other files - unless someone can guess the other filenames (or iterate to find them).
If you use a non-permanent bucket, then your original (untranslated file) becomes unavailable when the bucket expires, or you can explicitly delete the untranslated file (using the delete API).
Files translated via the View & Data API are not accessible via A360. They are stored in a separate area. (But I wouldn't be at all surprised if an A360 file access API became available in the near future :-).
Finally, unless you want to interact with the displayed file via the viewer's JavaScript API, you may prefer just to upload your files to A360, share the translated model, and then iframe embed them in your webpage.