That extra step is in there because I check the customer's IP address to ensure it's the same on every download attempt. If the IP address changes, I send the customer a new download link via email.
I know it's not possible to stop sharing files across the Internet. I think this process does a good job of preventing it -- without adding too much grief.
When purchasing a product that is shipped, shipping fields will appear below the credit card information fields.