tauon
Your reproduction case works for me. My working hypothesis for this issue is that it is occurring where there is no "filename" of the PDF visible to the browser from the URL, due to PDF mime-type content being served up in response to a GET request that's made against a .php URL.
In your test case, Safari downloads both with correct file names. Orion assumes the "private" file is called document.pdf.
Looking at the HTTP traces, I believe that in this case, Orion is not acting on the Content-Disposition header, since the below is seen on the private PDF query:
Content-Disposition: inline; filename="private.pdf"
If Orion was to use that filename, it would behave the same as Safari does. The relevant MDN guidance on Content-Disposition - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Disposition
