Do we need to grant 'view private files' permission to authenticated users to be able to download files after purchase?

Problem/Motivation

I have an e-commerce website. I used the Commerce File module to upload pdf files for my products. But I have a problem: after paying, the authenticated user cannot download the file.

I was able to download the purchased file after granting these permissions to the authenticated user role:
- File entity: Document: download any document file
- File entity: View private files

But I noticed an issue where authenticated users can view files in private folders that have been uploaded not from the Commerce File field

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes