We have been testing Conditional Access Sessions Controls, and there is a workaround that allows users to download some types of file. For instance, when editing an Word document through the Teams web app, the File > Save As > 'Download as PDF' and 'Download as ODT' options allow you to download files and in effect work round the controls.
Trying the exact same thing when editing natively in Word web app (i.e. direct in SharePoint) is blocked successfully, so looks to be a Teams/CASC specific bug.
I have tested in PowerPoint also and the equivalent options (Download as PDF/ODT) work there too when they presumably shouldn't.