Yes they can, as with any internet connection, but you may find it easier to upload files to a shared location for them to download. The "push from device" ala stolen smartphone.
The safest way to allow someone to quickly download files from your device whilst on public wifi is to use your private network via VPN and share a folder on that network. This is the "road warrior" scenario.
Otherwise, they will need to know your IP address. Dynamic DNS with SSH for concurrent login will also work, but they will need permissions on the files.Dynamic DNS can be home grown, you could email the IP or drop it on a server, say.
You could also RDP/VNC to a machine on your private network, still a two step process if you are copying from the host device first. Giving them remote control of your device is also possible ala NetMeeting, but clumsy.
The least secure method would be to run a simple FTP server for them to access. Anyone can snort that. It may not bother you if it is only a shopping list or a fender bender happy snap.
Encrypted file + VPN + RDP/VNC will give you three layers, not counting the WiFi encryption.
