MarkCanada

…well, I was able to add a referer check with the following on the top of the main .htaccess:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{QUERY_STRING} wpdmdl= [NC]
RewriteCond %{HTTP_REFERER} !^https://(www\.)?mysite\.com/ [NC]
RewriteRule .* – [F,L]
</ifModule>

It would be nice though to have the additional possibility of logged-in users only or even better with WooCommerce Membership integration.
Or maybe expiring links that only work for an hour or so. Or downloads just from the file’s page and not directly.