filesystem - standard is almost exactly the same as it was in older dnn versions, with one "bug fix", DNN now honors the role permissions on folders. You could still download files directly though (ie. by browsing to mydomain.com/portals/[portalid]/[foldername]/[filename]
filesystem - secure will create a folder that is secure, ie. all files in the folder will physically be appended with .resources, so they cannot be downloaded anymore directly. Of course, when downloading files with DNN, the .resources extension will be removed, and also, only roles with download access can download
filesystem - database will also be secure (because no physical files exist anymore). Files will be saved in the database, so you can only download them from within DNN. Of course, permissions will be honored. Mind you: putting lots of files in the DB is probably not a good idea, as the servers file system is much more efficient at streaming files. Also, your db can grow pretty large if you store files in it