from https://hackerone.com/reports/258710:

"The attribute download in a a tag allows for download the href target to file and saving it locally.
In mozilla and chrome, it is forbidden to download local file via file:// .., in Brave however this is not enforced and it is not clear to the user if they are downloading something remote or local. This could be abused to social engineering and phishing that is hard to spot without reviewing the js code."

Create a <a href="files:///etc///passwd" download>Download local file</a>
On a linux machine, click the link, download the file, open it. It's the local file.

Expected result file:// not allowd
Result file downloaded

I don't see much of a security risk here, but the same behavior is not possible in Chrome.

PoC: https://jsfiddle.net/zm2jfovs/ (try clicking the download link in Chrome vs Brave)