Microsoft on-premises server product that runs Office Online.
This is by design, as protection is embedded in the file itself. If you want them to be able to download attachments in unencrypted form, use the configuration detailed here: https://techcommunity.microsoft.com/t5/microsoft-security-and/admin-control-for-attachments-now-available-in-office-365/ba-p/204007