@ctietze I wrote about some of the options and their relative costs a long, long time ago: https://www.garfieldtech.com/blog/readfile-memory (It's on a very old version of PHP, but I don't think the basic feature has changed in 20 years.)
Basically, authenticate and then use readfile(). You'll be fine. Or authenticate and then use XSendfile (Apache), or equivalent (nginx).
Symfony as a response object that does this for you, as do good PSR-7 implementations.