The "Profile Specific Implementation Guidance" section says this:

• The content.url may refer to a FHIR Binary Resource (i.e. [base]/Binary/[id]), FHIR Document Bundle (i.e [base]/Bundle/[id] or other endpoint.

The last part "or other endpoint" is the only hint that a referenced document could live on an entirely different server, potentially with separate authorization requirements.

I wonder if it would be worthwhile to further specify expectations and provide guidance on what should be supported. For example, must these links – if outside of the FHIR base URL – always be accessible without additional authorization?