FancyThought

I think there is no ‘native’ support for it by the plugin, you could for the time being hide it with CSS?

I mean, the woocommerce uploads to the same folders I uploaded the file (uploads/woocommerce/year etc), and still woocommerce can access the file it uploaded itself, but I can’t direct access it in any way.

The WC runs locally (side by side with the web-server) on the server, .htaccess doesn’t affect it, it’s the reason why WC can write there.

It’ll delay the shop opening and a hassle to transfer the domain & setting up the whole shop elsewhere and I would’ve liked to avoid that.. 🙁

You can keep the domain registered where you have it and only point the domain DNS to the new server. Takes up to 12-24h to redirect it.
Regarding the setting up, everything is on the DB, export it and import it else where, fix the wp-config.php & wp-settings.php to reflect the new server credentials and you are most likely ready to go.

Did you try to download your test product with direct link when it worked?
– Yes, yes I did.

The “barrier” is a folder-based restriction from .htaccess (deny from all).
– There you have it, if it is denying all, you can’t access then. You would have to create some sort of ticket/session system and obfuscate the path with the header() function, I guess, so you could give out any name/path you wanted and still preserve the original path.

(…) deep in woocommerce there must be something that grants woocommerce special access to those files (…)
– I seriously doubt it because that restriction is applied by the web-server itself (through .htaccess) and not WP or WC, so I think there’s not much you can do about it. Even if you could make WP/WC access it, most likely the access would be local therefore an external user (visitor / buyer) would still face the same problem.

My advice is change to a better provider (or other plan in that company), in which you can control your own PHP config ou be able to change whatever parameter you need and save yourself the headache.