Hi,
If you want to provide free files, you can directly put the links in the product description or in a custom product field that would display on the product page. You don't need to use the files system of HikaShop.
Let us suppose that just as you said, the "whitelist" method is NOT secure, then, I think a positive solution is not "just reject remote files", instead, you can consider to develop some "ingration plugins" to let Hikashop work with remote files ( and these plugins uses API to avoid referrer bypass/cheating).
I totally agree with you. We could indeed develop plugins to integrate with the different cloud APIs for that.
It's actually in the todo list. I was just explaining you why that wasn't the case (each API is different, can be a lot of work, other priorities so far, etc).
PS: what is the point of sending the download link inside email? Why not just let the buyer download files directly from the page where they clicked "buy now" button, which will be turned into "download now" button after they finish the payment?
I personnally don't care. Both methods are fine with me and we propose both: download link in the email, and download link on the order details page of the frontend, and even in the downloads area of the HikaShop user control panel). Some merchants and customers do want the download link in the emails, which is why we added it. If you don't want it, you can always edit the emails and remove the links there.