Many people don’t seem to appreciate that most SharePoint sites in Office 365 are configured for sharing outside the organisation by default. This is designed to allow external parties to more easily access common content.
This means that generally, by default, users of those SharePoint sites (which includes Microsoft Teams) are going to be able to share links to that information. You can obviously disable this if you want, but generally, by default, sharing is enabled.
An easy way to see what the sharing status of your sites is current set to is to run the following PowerShell command after connecting to SharePoint Online:
get-sposite | Select-object url,sharingcapability
This will show you the one of following results:
Disabled – external user sharing (share by email) and guest link sharing both disabled
ExternalUserSharingOnly – external user sharing (share by email) enabled, but guest link sharing disabled
ExistingExternalUserSharingOnly – (DEFAULT) Allow sharing only with external users that already exist in organisation’s directory
ExternalUserAndGuestSharing – external user sharing (share by email) and guest link sharing both enabled
You can then go and make any adjustments you need to.