That setting, as far as I can tell, only refers to the AGOL / Portal "Export" button on the Item page. In a very real sense, any person who views the feature service on a web map is downloading parts of the data into their browser. A determined person could simply save the returned features to a file from their browser's cache. Or submit a query directly tot he REST endpoint. Or use any number of non-Esri tools / coding languages to simple scrape the service to the filetype of their choice.
We can do our best to make data slightly inconvenient to acquire, but fully preventing it can be hard. But not impossible! What I have seen other organizations do is present the data publicly as a map image with no data access. Little more than a non-interactive basemap, essentially. When their map was clicked, however, the coordinates were forwarded to a REST endpoint through some proxy (not my area of expertise, I may be mis-using terms), and the attribute information was piped into a popup from the intersection with that point. But the service itself was never directly exposed to the end user, and only attributes were returned. Even if you wanted to try intersecting a fishnet of points, all you'd have is attributes, no shapes.
I should mention, this setup appeared to rely heavily on third-party tools. I can't really speak to what goes into putting a setup like this together. But know that if providing public visibility to your data and simultaneously keeping it "locked down" is your aim, it's a problem I've seen others solve.
- Josh Carlson
Kendall County GIS
