This actually does not work great at all as the existence of the cookie does not indicate that the user is logged in, or even that he was ever logged in. All it indicates is that someone somehow set that cookie. To know that the user accessing the file is actually logged in or ever was, you need to actually validate the content of the cookie something that you cannot do in .htaccess.
Granted, that is good enough for probably 95% of the use cases, but if you “hide” something that might be worth “money,” you should rethink it.
In theory, the right solution is to avoid putting private information into the uploads directory, and have only public info there. The private info you serve from a URL you define in WordPress, for example a specific page, or with a special rewrite rule, after you check the credentials of the user.
For inspiration, you can look at how the EDD plugin serves its file to people that paid for them.y