Why would it be difficult to create a different tarball for each download? You can just have a separately compressed section with the random ID that is replaced on-the-fly.

Non trivial but a couple hours of work to implement and test probably.

tarball don't really have a footer or header that contains info of all files. To add a file to a tarball, all you need is remove the end-of-file marker, append to it and make a new marker. And that works extremely well with stream compressors (you just remake the last section).