How (and Where) to store downloadable commerce files outside the file system..?
You can configure the "Private file system path" to be outside your Drupal installation by changing it in the admin/config/media/file-system. and you configure your commerce files there. this should do the trick. either way Drupal do not provide direct url access to the private files.