Improved edd_block_attachments() to ensure files are not directly access