1 Answer 1
This is intentional by design. Files stored in the var folder should not be publicly visible to the world to access as it also contains various Magento logs/reports/files that aren't meant for users to see in the browser.
It seems like you would want to access a file like that via SFTP. If you absolutely must have it accessible from the browser, you might consider moving it somewhere in the pub/media folder, which is publicly accessible from the browser.
I would recommend considering any security implications of moving any files from var to pub/media.
Reason For 403 Forbidden
This is why you get the 403 forbidden on the var folder. If the site is running from apache, the var/.htaccess file is preventing access on purpose
If the site is running from nginx, I'm betting there is a rule in the nginx config to block requests to the var folder:
In var/.htaccess:
<IfVersion < 2.4>
order allow,deny
deny from all
</IfVersion>
<IfVersion >= 2.4>
Require all denied
</IfVersion>