Hi,
If you use a custom field of the type "file" and provide to it the name of the file that you saved in the upload secure folder of HikaShop, the custom field would automatically display a link to it with a target="_blank" on it.
So in such respect, there would actually be nothing to change.
So I'm not sure how you configured your custom field nor how you add the link to the file in the custom field. Did you use a custom field "text" type and then added the a HTML tag directly in its content ? In that case, it's normal that the attribute is removed. That is done by the filtering system in order to avoid XSS injection attacks via custom fields. It's possible to deactivate that filtering for your custom field by turning off the "input filtering" option of the custom field, but I don't recommend that for custom fields where the value is added in the frontend as it would make your website vulnerable to such attacks. A safer solution would be to edit the file "cart" of the view checkout" via the menu Display>Views and change the code:
$this->fieldsClass->show($field,$row->$namekey)
to:
str_replace('<a ','<a target="_blank" ',$this->fieldsClass->show($field,$row->$namekey))
That way, the target would be added server-side.