This is a good idea and sounds like something we might want to support in core as a flag to enable/disable download attachments unless you are a registered member.
I guess clicking the attachments with this flag set would trigger a login prompt?
Would also be safer from a bandwidth perspective, for sure.