Currently when trying to access to a file that does not have a collaboration right, it is registered as download in the activity report.
I have heard the support team that this is expected behaviour due to the backend work to read the thumbnail.
However, when looking at the activity log, it looks like a user has "downloaded" that file even though they do not have access to it so would like the report to not show "download" but something else to know that the user hasn't actually downloaded that file.