my $cpid = open (my $fh, "-|") || exec (@_);
[download]

Two things can fail here, and both times, you continue on if nothing has happened. The open may fail - if it does, the subroutine performs an exec, to never return (unless the exec fails). The exec might fail as well, meaning that the child executes the rest of the subroutine - and the rest of the program.

$| = 1; # line buffer
[download]

This unbuffers STDOUT. For the rest of the program. Now, your entire subroutine doesn't write the STDOUT, making the unbuffering pointless for the subroutine itself, and possibly damaging for the rest of the program.

close ($fh);
[download]

No checking of the return value? $fh is a pipe, and certain failures won't be reported until you close the pipe.

Also, if the timeout is triggered, the parent is killed (inside an eval). However, the spawned process goes on. Now, you might be lucky and it will write something to the pipe, getting a SIGPIPE and not surviving that, but you ought to kill the process (whose PID you store in $cpid, which currently is unused).