Hi,

Can you please consider to REMOVE

Tools / Backup

Backup SQL & Backup Files: STORE ON SERVER

Using that, sql and files are stored in the website root. While the name is hard to guess, i have never seen that kind of bad option anywhere.

Keep on the Download middle option. If you think it is something you do not want to remove, at least make those files avalable for a limited time (clean them after 1-2 hours).

Thanks

@dsf
Hard to say what's good way to do it. Maybe create ZIP with password would be better.