SharePoint Protect files on download loophole?

I've created a CAS policy to "Control file download (with DLP)" on for Guest users. I have the policy set to apply a protective Sensitivity Label and to "Block download of any file that is unsupporte...