One of our devs commented with:
Watching the video here https://u.pcloud.link/publink/show?code=XZJjwNkZlPi8t2RUuUfuwf9WAFcVaXW6jUGy, it seems the user is copying a post permalink which is not controlled by the setting and expected to be available. The option to copy the post text is not present, so the setting is working just fine.
As for the Excel file being able to save it to the files app, that is controlled by the OS QuickLook functionality, and what you could do here is to restrict downloading files in the mobile app by setting the server config.
For example, opening the same Excel file on Android will require the use of a third party application that can open that file type, and we don’t have control over that third party app.