If it was previously connected to the main page, it could possibly found on a search engine or in any previous visitor's history, or a link or reference, direct or otherwise, to that page might have been missed when they were removed from the main page. If, for any reason at any time, there wasn't a default web page in a folder, a list of all the files in that folder may be displayed. If the name of the page is just a word it could be guessed.
Although the last two are not very likely, it is still not very safe to restrict access to a page strictly by not linking to it. Some hacker with nothing to better to do with his time is likely to cause you some hell one of these days if you do.