Private filesystem
The private filesystem is used whenever we want to control access to the files being downloaded. Using the default public storage, users can get to the files simply by pointing to them in the browser, thereby bypassing Drupal completely. However, .htaccess rules prevent users from directly accessing any files in the private storage, making it necessary to create a route that delivers the requested file. It goes without saying that the latter is a hell of a lot less performant, as Drupal needs to be loaded for each file. Therefore, it's important to only use it when files should be restricted based on certain criteria.
Drupal already comes with a route and Controller ready to download private files, but we can create one as well if we really need to. For example, the Image module does so in order to control the creation and download of image styles—ImageStyleDownloadController.
The route definition for the default Drupal path looks like this:
...
