Nextcloud: Text does not respect 'Allow download' permissions

1. user0 shares a folder of sensitive images to user1 without the ‘Allow download’ permission
2. user1 just creates a new text file and inserts the images into it
3. Voilla the images appear and can be downloaded easily

These are just previews but still.
For the most common types you can even request the raw image https://github.com/nextcloud/text/blob/main/lib/Controller/AttachmentController.php#L57-L67

Impact

A user assume that the allow download feature works can still have their sensitive photos leaked.