I set up a download service a long time ago that gave a unique download path, like:
and added a mod rewrite match that would redirect to a download.php file that checked to see if that client had purchased the application (and specifically that version), and if they did would return the file from a non web accessible folder on the server. to the client from an http standpoint, the file was located on the server as shown, but behind the scenes on the server it redirected the output from another location.
the mod rewrite looked something like (this is coming from memory so it may be wrong):
RewriteRule ^/download/(.+)/(.+)/(.+)$ /download.php?uid=$1&v=$2&f=$3 [L]
and the download.php file then used the uid to look up in the db the customer & items purchased & what versions (from v) and would find that file on a directory above the website folder, and would send it to them.