It is usually considered a given that "private" downloads, going through Drupal, are slower than "public" downloads, which can be served directly by Apache, or whatever web server the site is running on. This is indeed true in the general case; however, for low-cost hosting, this apparent axiom needs to be revisited.
Context
I recently had to install Drupal 6.x for a french government agency on a low-cost hosting plan. Although the site performed reasonably well considering the limitations of the chosen hosting plan, I soon noticed it was missing mod_deflate and mod_expires, which caused pages to be served uncompressed and every static file to be served without an expiration date.
And, of course, the site had quite a few images: photos on most pages, and several logos at the bottom of each page.
Now, when mod_deflate is missing, using the "Page compression" option on http://example.com/admin/settings/performance
is a good workaround for the download page size, but what about the static files ?
Checking a few cheap hosting plans, it appeared these limitations are actually quite common. And without mod_expires, there is no way to tell Apache to serve static content with specific headers. Luckily for us, with Drupal we have a trick up our sleeves, the so-called "private" file downloads.