So you want to give a customer a unique and unguessable link to the product, but you don't want them to have to enter an ID and password? An ID and password would be something from cPanel's "password protect directory" function. That's what you had there -- what other "protect with .htaccess" function are you thinking of?
I suppose you could randomly generate (from letters and numbers) a ridiculously long directory name for each customer's purchase -- say,
http://yoursite.com/downloads/73gkjfpouj324r9grweoiretpiewo8uytjwsh/product.zip. From your viewpoint, it's probably less work than generating an ID and password using cPanel would be. From the customer's standpoint, it's probably more work to type in a long directory name than an ID and password, although it's not bad if you provide a clickable link in an email.
Don't forget to either disable automatic indexing (or put some sort of index.html) in the /downloads directory, so that no one can browse the directory and see all the funny long names and follow them to steal stuff.