Just checked to make sure, but the permission doesn't seem to cascade. You can restrict a user from downloading a vApp Template, but they can get around the restriction by just instantiating the vApp and downloading it from the My Cloud tab.