Steps to reproduce:

1. create a secured folder in DAM (e.g. /secured)
2. upload an asset into the secured folder, e.g. file.pdf
3. create a page (e.g. /test), add a Download Link pointing to the /secured/file.pdf asset
4. publish both page and asset
5. on public instance, specify the ACL on DAM for anonymous role:
   1. DENY on /secured (and subnodes)
   2. READ-ONLY on / (and subnodes)
6. in a different browser, go to the public instance, open /test page, and click download link - one would expect Error 403, but it opens an empty file;
7. try the download URL also in wget - it downloads zero length file;