Prior to 2017 if you disabled the "Copy outside of vault" it would restrict the user from downloading the native but could still download load the rendition, this was very useful to allow view only users to download renditions from the Master area. In 2017 this bug has been fixed, so now the user cannot download the rendition without the "Copy outside of vault" privilege. It would be beneficial to split the "copy outside of vault" so there was a separate privilege for each file.