Files belong to their project context.
Project attachments use private storage and application access checks. Access to a file is checked against the signed-in user and the related project or record.
A downloaded PDF or exported spreadsheet is a separate copy. Your team controls where those copies are stored and how they are shared.