Hi,
1. The safe directory is created automatically in media/com_hikashop/upload/safe so it's normal that you don't have it in images/com_hikashop/upload/safe. You're not looking at the correct place. And there is already a .htaccess in it.
2. It depends. If you just enter the filename in the "files" column of a CSV you're importing, then yes, you want to put the files in the media/com_hikashop/upload/safe folder. However, if you're specifying the absolute path or a URL to the file in the files column of the CSV, that shouldn't be the case. And if you're importing from a folder, that folder shouldn't be the upload/safe folder but another folder where your files to be imported should be.
3. Before checking the link in the email, check the link in the order details in the backend. That backend link circumvent all the checks on the order status, etc. If that link in the backend doesn't work, it means that there is a problem with the file/the import/the upload safe folder or something like that. If that link work, then the problem is that the customer is not able to access the download ( file download time expired, file max number of downloads reached, order not confirmed, etc).