That is partially correct in that the file is not necessarily downloaded as a file. Certainly parts of it must be sent to the user's screen, else they'd never see it. So for example, here is a capture from Google Drive. It shows thumbnails which require no input whatsoever except to log in to Google Drive.
This alone would be a useful and significant improvement in the Files option. Now, if one right-clicks a file, the option to preview it using Google's own app pops up. Now I realize that the image is sent to your browser, but you don't need to do anything for that to happen except select Preview. I'm not a programmer, so I cannot speak to any perceived or real cyber threat, but clearly Google doesn't think it's much of a problem. And the file itself is not downloaded, although the option is there, too.
I'm not a huge Google fan, but this is a very handy feature. IE, not having to download and save files in order to see what's in them. Thanks for considering the suggestion.