Displaying the key is totally optional, but it isn't a security issue even if you do. You need to check if the user has access, always. That is your job, not the framework's.
But you don't have to use a numeric id. I like to do something like the content type and title in the url:
I then use that information to find the piece of content. Not for security reasons, the title is only superficially more private than an id, but for usability and/or SEO.
I also like to allow the user to get rid of the slug (title, whatever you want to call it) in the URL and receive exactly what they expect. Again, just usability, not security:
/properties/address-of-property (single property)
/properties (list of properties)
MVC apps often have a default convention of controller/function/id. That is just a default. There is no reason to use it if the URL matters to you. Tutorials will usually teach the defaults, but after the tutorial you can (and should!) learn more. Then change things to match your needs.
In every framework I have worked in, there has been a way to map urls to functions and pass in parameters (whatever part of the url you want). They have, without exception, been called "routes."
Use well thought out routes if you want a more user/search engine frindly url. Or use the defualt if you don't need better urls, but just want to quickly build the app. Either way, check if a user has permission to see something. Always.
Knowing the URL must not equal able to gain access and it is your job to enforce that, no matter what your URL looks like.