I'm not able to run the download test for you but the symptom has a standard cause and it explains why you can't reproduce it.
Windows SmartScreen flags unsigned executables on reputation and that reputation is tracked per file hash. A brand new unsigned build has none so some users see the warning and others never do. Your own machine is the worst possible test because it already trusts a file it has seen before. Android does the same thing through Play Protect on a sideloaded apk.
So it's probably not your page and not an infected file. It's the missing signature. Signing costs money but it's the only thing that clears this properly.