You can download objects from S3 from EC2 without traversing the public internet using things like gateway endpoints [0] which avoids s3 egress fees. But doesn't avoid egress fees from EC2 to the end user.

[0] https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpo...