How to mask external download links to be only accessible by logged-in users?

I will make an assumption, based on your question:

You care how your link is output by the back-end and a JS-based solution is not good, since it defeats the assumed security.

My suggestion? Instead of doing checks virtually everywhere in your codebase where there's an output link, in your set-up, as early as possible after the user has logged in, do:

$user = wp_get_current_user();
if( $user->exists ) {
    add_filter( 'public_link_root', function() { return 'example.com'; } );
}

Whenever you have to output a link, instead of doing that check over and over, because it's already established that the user's logged in, if you wrote your system in the correct manner (and you can do additional checks), do:

$link_to_output = apply_filters( 'public_link_root', 'ourwebsite.com' ) . '/resources/whatever/here';

Don't forget to esc_url whenever you output the link, you can wrap all this in a function if you want.