Under role rights some right exist around this... I have not tested in VCD 5.5 to see if the behavior has changed. But in VCD 5.1 under "All Rights":"Catalog Item" you can "Enable vAppTemplate/Media Download"
Have you check to see if this right cascades down to the direct vApp, (not sure if VMware missed this one or just joined the right)