My inclination is to allow only the ability to download existing files for users without editing ability. I guess the ability to upload files can't do much harm. The main thing is not to allow deleting or replacement of existing files which is liable to change the contents of the course.
If one's course consists (almost) entirely of uploaded files, then this is a big security hole at the moment if one thinks that setting a users editing off locks them out.
General developer forum
Editing off - Sanity check
This discussion has been locked so you can no longer reply to it.