Your advice on private user document management (static resources?)

Ok, thanks. It might be the easiest way in this case. And if I offer the download links with the FileDownLoadR snippet the url's will be hashed as well. So I would think that this approach means that:

1) no one can access the file directory directly, because of the htaccess directive;
2) no one can guess and type in the urls of files of others, because of the hashed FileDownloadR links;
3) on the page with the download links, I do a check to see if the logged in user is allowed to see the page at all and based on his ID I only show the downloads he is entitled to see. This restricts other users from seeing not allowed download links;
4) if I don't create links to the urls of the individual static resources (but only list them with the hashed download links on a page) or maybe don't even publish the static resources (don't know if that would work) they won't be accessible or 'guessable'. So I'm kind of bypassing/not using the static resource url and am grabbing the original file location and obfuscating it with FileDownloadR, if that's making sense.

Am I missing something crucial in making these downloads as secure as possible (besides putting them outside of the webroot)?

You can still use Static Resources. Binary Static Resources are taken out of the normal MODX processing, and are streamed with the appropriate headers.