Actually it's not a separate issue see the attached screenshot. What you are saying that Firefox should report a message that the download is not from HTTPS and ask if you still want to download is correct. However for some reason that's not working on your website, it's trying to force HTTPS and that's with stock Firefox settings and no extensions. When you click the download link in Firefox for example it redirects to https://update.virtualisoftware.com/filename.exe (ie. filename.exe being the requested download) And even if you try right clicking save as it does the same in Firefox.
Our site is not forcing https because, as I've said, we still haven't installed an https certificate on our site. In your case, it seems the browser is trying to use https, even if the site doesn't have it yet. So, clearly, if you click to a link that is http, but your browser shows as https, it will give a 404.
Which is a different issue than if you click on an http and get a warning it's not secure, which should usually happen only in case of what the browser detected as "mixed content", that is a site with https containing http links. But that's shouldn't because, as I've said, we still don't have https on the new site, we WILL add it soon, but the correct address for our site is http, no idea why some browser decided to show it as https, considering we don't have it yet.
In any case, we updated all links now to be relative instead of absolute so, I think it might fix the problem and use the automatic https from Cloudflare without being flagged as mixed content.