The problem is not a matter of file-system permissions, it’s the web server that doesn’t let you get the file. You’ll find an .htaccess entry for this.
This is likely on purpose, due to security issues - you can’t let people download any images from your server just by trying file names in the URLs. You have to go through an authenticated entry point.
The link generation doesn’t seem correct to me, it’s likely a SuiteCRM bug. I just tried it on the live demo and it doesn’t work there either.
See some discussion here: