One thing to consider is that like any other requests, it can be intercepted using something like Proxyman. This means that unless you encrypt the files yourself, the user can intercept the download and get full access to them.