ah, that is a good point. I will test it right away.
EDIT: Ok apologies, you are right, only users with access to the post can download the media. Still, it is not limited to actually clicking on the post link, so given that the link was copied, and the user has access to to original media - I still think it should allow to download it without forcing the user to copy-paste the URL to his address bar