.obj file security

How do you secure the files from being downloaded? i.e. if the user has a link to the wp-content>>uploads folder where the 3D files are stored?

Can your shortcodes be used to add an image in the gallery for a real product, or will the purchaser get a download of the 3D file with their order?

Thanks for your clarification.