They don’t have to have the capability to do so for the legal team of the county to make a specific rule to make it abundantly clear that in case a piece of tech can download (somehow got a permission missed by it setup) that doesn’t imply the user has permission to.

This is a cya by the legal team, not a directive from IT.