There is no configuration for the download action in the PdfJs previewer and the download action is not limited based on permissions / roles of the user. If the user is able to access the preview, they have all the required permissions to download it. Are you sure you are using the default document previewer, e.g. haven't installed a 3rd party component which might alter the behaviour? What types of documents are you previewing where you see this kind of behaviour?
