The first paragraph here answers your question:
https://jalbum.net/help/en/Skin/Tiger3/Sections/Shopping_cart
In short, there's no server-side processing in a jAlbum album. It doesn't know anything about what a customer may, or may not, have purchased. It can't decide whether to allow a file to be downloaded or not - if there's a download link on the page, absolutely anyone can download the file.
The PayPal transaction is, in effect, invisible to the album - the album just passes the customer along to PayPal. That's the end of the album's involvement in the process.