Private files download as different name after anonymous user gets redirected

It seems that a patch for this is not necessary. There is a hook_file_download that we can use:

This hook allows modules to enforce permissions on file downloads whenever Drupal is handling file download, as opposed to the web server bypassing Drupal and returning the file from a public directory. Modules can also provide headers to specify information like the file's name or MIME type.

/**
 * Implements hook_file_download().
 */
function hook_file_download($uri) {
  $filename = \Drupal::service('file_system')->basename($uri);
  $disposition = 'attachment; filename="' . $filename . '"';
  return [
    'Content-disposition' => $disposition,
  ];
}

Replace the hook in your function with your custom module name.