A package has both a public and a private link until the zipped file expires (aka, is “cleaned”).
If the package was created by a distribution, then the link on the Distribution page is the private link.
The private link is accessible by admin users only. The public link can be shared with third-parties.
Note: The public link expires in a specific number of days, defined by the “Package Cleanup Span” setting.