> also of note, we (mostly) don't allow ~/Desktop as the download dir for security reasons

This isn't an XDG issue. It's a chromium engineers being silly pricks that think they know better than the power users who obviously went out of their way to create such a configuration. Also I bet it would work if you set your XDG_DESKTOP_DIR to ~/Download/