Believe it or not, that’s actually correct. A few versions back BigFix switched to generating the download URLs in relevance, which had two effects.
Because the download URL is inside a relevance tag, the “%25” code is needed to do the character substitution for a “%” character, so “%2520” ends up evaluating as “%20”. You can’t just copy/paste it into the browser for that reason. And because it’s in a relevance tag, the URL needs to be added to the BES Server’s DownloadWhiteList.txt to allow downloads from that URL.
See https://www.ibm.com/support/knowledgecenter/SS6MCG_9.5.0/com.ibm.bigfix.doc/Platform/Config/c_dynamic_download_white_lists.html for details on downloadwhitelist.txt in general. The file takes regular expressions as values, in my file I added