The "Download Method" option Downloads > Settings > Misc has to be set to "Forced" in order to file protection to be in place. Once you change that setting, it will create a new .htaccess file with the following rules:
deny from all
Allow from all
If for whatever reason that file does not get created in wp-content/uploads/edd, you can easily create it.
Note, the "Forced" download method does not work on 100% of servers. It almost always does, but there are exceptions. When it doesn't work, the method needs to be set to "Redirect", which does not have as good file protection. The Symlinks option is only available when the method is set to Redirect.