How come even though I put a url to mask the AWS S3 address, when I download a product from Downloads, it serves it to me on the S3 link?

It also does this with attachments to download in posts, while images are correctly served on the custom url set to Storage

 

Any ideas?

This is intentional right now, but we do have plans to re-visit and see if anything has changed since we last looked at it. I believe it required using Cloudfront signed URLs instead of S3 signed URLs.