Support for private files system, or similar access restriction

I was actually able to get a proof of concept working where the path alias of the media entity is used, but the image content is displayed inline in the browser.

Here's what my EventSubscriber looks like:

  public function onRequest(RequestEvent $event) {
    // Get values from the request.
    $attributes = $event->getRequest()->attributes;
    $media = $attributes->get('media');
    $route_name = $attributes->get('_route');

    // Redirect to the file directly if we are accessing a media entity's full
    // view mode route.
    $view_mode = $attributes->get("view_mode");
    if ($media && !str_contains($route_name, 'media_entity_download') && $route_name && $view_mode === 'full') {
      // Get the source for this media entity.
      $source = $media->getSource();

      // Grab the ID values from the source information to be fetched from the
      // Acquia DAM.
      $id_values = $source->getSourceFieldValue($media);

      // Get the client for the Acquia DAM and get the asset object.
      $client = \Drupal::service('acquia_dam.client.factory')->getSiteClient();
      $asset = $client->getAsset($id_values['asset_id'], $id_values['version_id'] ?? '');

      // Get the embed URL for the asset.
      $url = $asset["embeds"]["original"]["url"];

      // Create a response with the URL's content.
      $response = new Response(file_get_contents($url));

      // Create the disposition of the file to display it inline.
      $disposition = $response->headers->makeDisposition(
        ResponseHeaderBag::DISPOSITION_INLINE,
        $asset['filename']
      );

      // Create the MIME type from the Asset's properties.
      $mime_type = $asset["file_properties"]["format_type"] . "/" . $asset["file_properties"]["format"];

      // Initialize headers for the response.
      $headers = [
        'Content-Type' => $mime_type,
        'Content-Disposition' => $disposition . '"',
        'Content-Description' => ' File Transfer',
      ];

      // Return the response object.
      $response->headers->add($headers);
      $response->setStatusCode(Response::HTTP_OK);

      // Dispatch request
      $event->setResponse($response);
    }
  }

Tagging as a feature request, we'll raise internally.