Authenticated users can download any invoice

you can use this patch if a patch is needed while waiting for feedback

Cannot reproduce the access problem on the 2.0.0-rc5 module version.

Cannot reproduce it on 2.0.0-rc5.
Is your private files directory correctly set (eg: sites/default/files/private)?