Yes, we do not require the user to be logged in to download attachments from the public ticket URL, provided the option to access public URLs is not enabled for logged in users only. This can be checked from Admin-->Service Desk Security.