Yes, a file in a directory is only accessible to users who have the execute permission on the directory. It's like leaving jewelry in an unlocked drawer inside a locked house: the jewelry is under lock.
A random user cannot create a hard link to a file, only the owner file. If the file has multiple hard links, some of which are in a publicly accessible directory, then the file will be publicly accessible. But that has to be set up by the owner of the file.
Anyone can create symbolic links that happen to point to a file, but that doesn't allow them to access the file. Symbolic links do not bypass permissions.
If the directory is world-executable at some point and there are processes that have the file or a parent directory opened at the time you restrict the permissions on the directory, then those processes still have the file open afterwards. However if they close it (or move out to another directory) they won't be able to reopen it (or change directory back in). Similarly, a setuid or setgid process may open the file or change to the directory, then drop its permissions. All of this requires the cooperation of the file or directory owner.
There is no way to open a file via its inode. The fact that this would allow to bypass restrictive permissions such as this case is the main reason why this feature doesn't exist.