(In reply to Paul Zühlcke [:pbz] from comment #6)
I noticed that the external protocol handler permission dialog seems similar in that the accept button isn't focusable and it falls back to the first link label (choose application). Maybe we should address that too.
From a security perspective "cancel" seems like a sensible default (we would go to the previous behavior?). But I haven't worked on the download dialog before so I'll leave it to mconley, maybe gijs?
bug 1749028 is relevant context here. So we should definitely not focus accept/OK.
The confusing thing is that if you change the default button in the dialog, that also impacts what [esc] and [return] do (at least on macOS, where that doesn't activate the focused button but the default button!!). You don't want [esc] to accept the dialog. But you do want the cancel button focused, or at least not the "OK" button.
Although this is a change, I'm not convinced it's really wrong to focus the file field? From a security pov, anything other than [OK] is fine. And [enter] should still accept the dialog once the OK button is not disabled, right?