Hmm... I'm not too sure, so I'll invite others to chip in here. One thought I'd have would be to make a folder in your files directory w/ a funny name (i.e. customers probably won't guess it) and use .htaccess to restrict access to files in that directory. You can view Drupal's default .htaccess to see where it restricts access to certain file types and add the necessary limitations for your downloads.

Anyone know if there are holes in this method?