The only thing that's user error here is the developers of Fiverr exposing files without proper session authentication.

That’s very often a deliberate design decision.

It’s bizarre UX if you link a file to someone and the link doesn’t work.