How I see it right now is that after user pays for an extra (say, a digital good), they'll have to go to an external link to download it.... And I think that's really not safe. What if the user who paid for the Extra will directly share the external link to others so that they don't have to pay?

Please have an option to upload files in the Extras, so that the file will remain locked until payment is made.