For consistency, URLs are censored in forum posts meaning you can remove domains from being posted (both the text and href are censored), but this does not extend to External Purchase URLs. I personally would like them to be censored as well.
This is more of a bug, so I've fixed it. The URL isn't directly exposed, but it someone tries to download it, it will tell them it's not available. (This runtime check is done as censoring may change over time.)