Cookie-based browser tracking can never be completely accurate for a variety of reasons, most notably browser settings or extensions that block or delete cookies, that disable or interfere with javascript, or that block social-media or tracking scripts/cookies in particular. Most often this would result in under-reported conversions, but it can also result in over-reporting -- e.g., if a user deletes their cookies, or switches to a different browser or computer, and then visits your FB page and subsequently reloads any thank-you page of yours to try downloading again, that could track a duplicate conversion.
Our only involvement in FB tracking is inserting the tracking code you provide into the thank-you pages we generate for you; our servers don't actually run that code or contact FB's servers or do anything else behind the scenes for that at all. Rather, the buyer's browser runs the tracking code when they load the page, so it's their browser that contacts FB's servers and transmits their FB tracking-cookie ID to FB at that time.
Our thank-you page generation script has no way to distinguish paid downloads from free downloads issued individually or en masse via Updates. The page is generated the same way regardless of how the link(s) were issued, so it's conceivable that users who visited your FB page before claiming their free download would have tracked that visit as a conversion. To prevent free links tracking as conversions, you might consider putting your FB tracking code in the Product Thank-you Page HTML field, then create a separate product for free links and Updates that doesn't have that tracking code and uses "Bundle other products" to issue the original product's file.
Just to speculate out loud here: I wonder if FB has any way to specify what part(s) of the conversion page URL should either matter or be ignored -- e.g., Google Analytics has a type of conversion goal they call "head match", where they only pay attention to the first portion of the URL and ignore the rest; if FB tracking supports something similar, you could specify "https://www.fatfreecartpro.com/ecom/rp.php" as the base URL, or tell FB to ignore the query string of order-specific parameters we always append after that, so the same visitor using the same browser with the same FB tracking cookie might track as only one conversion no matter how many links you've issued them or how they were issued. Or, if you can tell FB to ignore visits to any URL containing a certain string, you could have them ignore "jg-" (for Free Checkout orders), "j-" (for free links issued individually) and/or "u-" (for links issued in an Update), which might still allow each paid order by the same buyer to still track as a separate conversion.