I just checked some before-and-after samples, nothing is being added to downloads AFAICT. Only difference is the Date Modified on the zip, when it hits your HDD.
Shower thought: A good obfuscation tactic for bleeders should be to use Touch or similar tool to retouch the Date Modified on the downloaded file to a timestamp before the purchase date, so that it looks like Blendin Blandin probably shared it, and not That One Guy We Been Watchin' who bought the only one sold that day and shared it an hour later.