if the downloads were not idempotent, then yes, this method will simply splice two different files together. But presumably, most downloads are idempotent.

It would be good to have a hash as part of headers, otherwise this is not an acceptable risk by default.