DSpace has events for certain actions, but I don't believe there is anything that you can chain ahead of a download, that will allow you to alter the contents. I have built a cover-page generator for DSpace, that is custom code that on-the-fly generates an altered version of the PDF. This doesn't affect the Archival/stored version of the PDF, just the Disseminated/downloaded version of the PDF that the end user receives. The admin user gets the Archival version, when they're logged in.
The place where we altered the code to make this happen was in XMLUI's BitstreamReader, where we added some logic to determine if this object was eligible for watermarking (i.e. is PDF?, is enabled for this collection?, is user non-admin?).
For this feature to be considered more complete, it would be wise to also clean it up so that all bitstream-serving endpoints (JSPUI, XMLUI, OAI, REST, ...) also had the same logic.