I raised the same issue previously. If your Web AppBuilder isn't from one of their trusted sites, the sandbox will block downloads. For me, the issue arose with using a Web AppBuilder within our ArcGIS Enterprise. Unfortunately, they won't change this behavior. Their explanation is below.
"For safety reasons, the embedded app inside the ArcGIS Experience Builder Embed widget is constrained by the same-origin policy. For domains other than *.arcgis.com or *.esri.com, the sandbox attribute is automatically added. This is stated in the Embed widget documentation in https://doc.arcgis.com/en/experience-builder/configure-widgets/embed-widget.htm#ESRI_SECTION1_280578.... In order to download embedded content, the 'allow-downloads' property for the iframe must be supported, while the sandbox bans it. The CSV file cannot be downloaded because the domain in Portal for ArcGIS is not a trusted domain. The CSV file can be downloaded if the portal has a trusted domain (for example, *.esri.com). This is a known limit and will not be addressed."
