We also implement all 3 of these methods. We have even a bit more complex logic where we use combination of these on a single form.
For somebody new requesting the content, we send the asset using email to make sure we have correct email. But if we already have valid reachable email address, we use the other 2 methods.