I had to find this out for a customer this morning.

It’s true: Being able to read something means they’re okay with exporting to a spreadsheet. We may need to “Lock this down” but all I can think of is to use javascript to hide the control, which is not really locked down per se.