Ok, so I didn't read all the replys but the whole idea with databases is to gather information ready to use on your site. With a database your able to hide information giving the exact position of your images on your FTP. So by just locking the specific urls or a subdomain is just stupid as there are lots of bypasses.
If you want security, use a database - it's actually not hard to get a grip of the SQL. Give it an hour or two and youll be able to build your own database. You will also be able to restrict certain users to areas and folders this way.
Good luck!