Under the checkbox to set a custom URL there is this warning: "Custom URLs should not be used when sharing sensitive content."

Custom URLs are not the problem! Anyone who guesses a custom URL and is thereby able to access it already had permissions needed to access it.

The warning should be "'Anyone with the link' should not be used when sharing sensitive content" and it should be in the prior popup.

Meanwhile, when a user has created a restricted link and then comes here to make a custom URL, the existing warning creates needless Fear, Uncertainty, and Doubt in the user, making them worry that using this feature will make their "People in my company" or "Invited people only" link less secure or less suitable for sensitive data.