Loophole with attachments on a job with NDA

I have seen that the buyers requiring an NDA may have intended to have the NDA signed by sellers before they could glance at (or download) the attachments that they added to the project.

However, sellers can do it without signing an NDA. I believe the PPH team should update the coding/access permissions to allow only the signers to be able to glance/download the attachments.