As many others have stated these DECRYPT functions do not work as intended, for anyone receiving the message who is on O365 for email.
Set-IRMConfiguration -DecryptAttachmentForEncryptOnly $true
No matter what this is set to if the receiving party is an Exchange Online tenant they cannot open attachments. Tested with over 15 different domains, all of these users are setup for email in O365. This needs to be a top priority for OMEv2, and is a glaring issue for anyone attempting to make this switch.
If its someone who is @gmail.com or @yahoo.com or @hotmail.com they can receive the message and attachment fine.
DO NOT GO TO OMEv2 until this is resolved. There has been no communication from Microsoft regarding this being a known issue, and should be in their Service Alerts in the Admin Center.