fota_download_start copies the file but not host string into a static buffer. The comment implies that the download_client only requires this for the file path, though it's actually needed for both since the download client only stores the pointer.
Other instances of the download_client do it for both, such as the shell.
https://github.com/nrfconnect/sdk-nrf/blob/main/subsys/net/lib/download_client/src/shell.c#L16