As long as there is still no way to decompile an AAB, I only see this option:
You can download the files (assets) on the first run to the ASD, copy them to the privateDir and then remove them from the ASD. In this way, the files are still in the internal storage and cannot be accessed without a rooted device.