The permissions for environments give you the option to allow people to download and create backups. It would be a great improvement if those rights were split in ‘download backup’ and ‘create and restore backup’ permissions. This gives you the option to allow developers to create and restore a backup, without allowing them to download the data locally.
So the permissions for downloading and uploading a database are an explicit extra security group.