When Safari downloads a large file, it temporarily creates a .download folder and stores data inside there. This .download folder is actually registered as a package. Confirmed by looking at /Applications/Safari.app/Contents/Info.plist and seeing download file types as registered packages.
$grep '>download<' Info.plist -B4 -A15 </dict> <dict> <key>CFBundleTypeExtensions</key> <array> <string>download</string> </array> <key>CFBundleTypeIconFile</key> <string>download10.icns</string> <key>CFBundleTypeName</key> <string>Safari download</string> <key>CFBundleTypeRole</key> <string>Editor</string> <key>LSHandlerRank</key> <string>Default</string> <key>LSTypeIsPackage</key> <true/> <key>NSDocumentClass</key> <string>BrowserDocument</string> </dict> <dict>
The .download registered file does not get treated correctly by an application in use, so the sensitive data is not stored in the sensitive data drive, but redirected to the local drive then needs to be manually moved to the sensitive data drive after it is completed the download and obtained the original file name.
So the question is: could this behavior be turned off so it download to the original filename, or some other type or maybe modify this registration so that the .download extension will not be registered as a package?
Thus allowing the file to land directly on the data drive.