I see the nmap tarball is 20 Megabytes = 50,000 downloads.
The cost of hosting should be easily covered by your user base.
Would the $5/month droplet stand up to a surge of people coming in for a latest release, or a bit of press coverage? Would there be enough bandwidth that everyone gets the file fast or would they all slow to a crawl
If the project doesn't want to manage their own infrastructure, they're probably going to want a CDN or object storage provider. The most cost-friendly I've seen is OVH's RunAbove object storage, but I'd be interested to know if there is anything else comparable.