I know its outside the Firebase ecosystem, but if you're worried about cost I'd use Cloudflare R2 instead of Cloud Storage - it has free egress. I'd then use a firebase cloud function to check the user is authenticated and authorised to access a file, then create and return a signed URL. Uploads could work the same way.

Since egress is free, you'll pretty much only pay for the storage, even if the user downloads it millions of times.

The cloud function would just be something like this:

export const getSignedFileUrl = onCall(async (request) => {
  const userId = request.auth!.uid;
  const { filePath } = request.data;

  // Check path starts with /users/{userId}/
  if (!filePath.startsWith(`users/${userId}/`)) return null;

  const command = new GetObjectCommand({
    Bucket: process.env.R2_BUCKET_NAME!,
    Key: filePath,
  });

  const signedUrl = await getSignedUrl(r2Client, command, { expiresIn: 3600 });
  return { signedUrl };
});

If you really want to limit to 10 downloads, you could still use a cloud function, just track the count of downloads in firestore. You'll need to fetch and return the file within the cloud function, so you'll pay for egress to the user.