Sync respects the permissions set within the portal. I would make sure that you have view permissions unchecked for ALL the associated roles (Guest, Site Member, etc.) of the user. Also, the user that you are testing with should not have admin privileges as they can have access to all files.
However, I don't recommend changing permissions on the png files itself. This will prevent the theme from showing the images to the users as well. Though it may probably take modifications to the theme (changing paths), I would move all the theme files into a folder and unset view permissions on the folder. This way, users will not have access via the document library or sync but have direct viewable access to the files.
