There was nothing about newlines being disallowed in the brackets. The following is faster and more likely to match correctly:

s/\[.*?\]/~~/sg
[download]

But that's risky, especially if you use it a larger pattern. The /.*?/ could match a "[" or a "]". That's obviously undesirable. The following pattern avoids that problem:

s/\[[^\[\]]*\]/~~/g;
[download]