This is just a minor note but a really powerful piece of information. Eric Stevens of the B And E Blog did some memory usage testing involving ColdFusion 8 and the CFContent tag and the findings are very cool:
I just did a test in CF 8 using FusionReactor to watch memory while using <cfcontent type="application/x-zip-compressed" file="#ExpandPath('bigfile.zip')#">
Memory was at 141mb when the file started, memory was at 151 when the file transfer completed. The file was 302 meg, and the transfer took about 2 minutes. The memory graph never spiked, and never went over 151 meg, though it did clearly do a garbage collection in the middle of the transfer and drop down to 141 meg before rising gradually to 151 again.
Long story short: it looks like <cfcontent file="..."> uses buffering to transfer the file, it doesn't consume an inappropriate level of resources.
Not to reiterate what he just said, but it looks like our assumptions were wrong - ColdFusion's CFContent tag is being smart about the way it reads in and streams file data to the client browser. Clearly, memory usage should not be a concern when it comes to the use of CFContent to stream secure files out of a document library. And, as I have been told before, tying up the thread to stream the file is not much of a concern either; I have no real evidence about the thread usage one or the other, so I just have to go with what I have been told.
Based on the evidence and hearsay, ColdFusion's CFContent tag is nothing but totally awesome and should be used whenever necessary. Or is that too big of a leap in faith?