Well, they are 2 different things. Supabase is a Firebase alternative but I believe you can also host media.
Cloudinary is a quality “public” media server but AFAIK at this time, setting up 'user specific" authentication is not possible.
The delete function may come later this year, but it’s not a top priority at this time as there are workarounds available for that.
I am wondering why they need to be in specific folders. Would UUID’s not offer enough protection? I know Firebase and S3 allow for easy and programatic folder destinations for your media. Cloudinary too IF you were using the standard API (I believe).
It’s a bit silly, but, you may look into uploading to cloudinary, triggering a cloud function to then take the uploaded image, throw it into a folder, delete the original image keeping the newly moved file, resize and add watermark.
You might be able to do most of this via Integromat/Make/Zapier/n8n and skip adding these actions to a backend.