I’ve seen mention before that they’re working on new ways to provide avatar creators the tools to share avatars and avatar accessories as part of their Creator Economy initiative.
It may be presumptuous of me, but I could easily see them providing a way of sharing a packaged avatar to be uploaded without Unity. They’re already adding the ability to upload avatars without entering Play Mode, which would be a step in such a direction.
In the meantime, officially you’re supposed to package and export the avatar files for your friends to upload.
It’s… not ideal, and it is frustrating that there’s no concept of “shared” avatars to sit between public & private. But it’s how the current system works.
Also, some of those avatar search worlds have instructions on how to prevent avatars from showing in results by adding special text in the description. I don’t believe they’re accessing the API directly to search for avatars, as I’ve noticed my public ones don’t show up! Rather, they’re cataloging the IDs of public avatars they’ve encountered.
In all though, I’m of the opinion that the current avatar system as a whole makes no sense. — If an avatar is public, cloning shouldn’t be an issue, and it makes no sense to allow restriction of such. It’s a bandaid solution to the problem of them not having that “middle tier” aforementioned that would allow an avatar to remain private, but shareable amongst friends (more or less an “unlisted” avatar that could be optionally cloneable and incompatible with pedestals, whereas public cloning would be enforced.)