Wow. I didn't know people could do that. TBH the amount of people who would think of something like that should be small enough to ignore. But if not, I don't think there's a way to stop them from being able to right click the button in the incentive email and get the download once it's there.
You could always remove the download from the incentive email and instead set up a welcome sequence email with the download link set to send immediately after confirmation (0 days under when to send). That way the only way they'd be able to get the download is to confirm.