Earlier quoted context omitted.
Only allowing the owner to share an album is a false sense of security. If someone can see your album, they could just as easily download the photos and make them public. Instead of disallowing it outright, I'd rather they make it clear that you're sharing content with a wider audience. One solution would be to require that the owner approves the share, similar to how tagging is handled.
That's good idea. But it still wouldn't solve the issue of people downloading the photos and making them public.
This, in my opinion, is where Google+ is failing: sharing makes it very easy to make private posts visible to an audience larger than the author intended.