In ArcGIS Online, it seems impossible to prevent a user from opening a Hosted Feature Layer (or any of its Views) in ArcGIS Desktop. Once a Hosted Feature Layer (or any of its Views) is opened in ArcGIS Desktop, the user is able to export that data. This is a severe security issue.
There should be a way for ArcGIS Administrators to prevent users (named users and/or Everyone) from opening Hosted Feature Layers (or any of their Views) from within ArcGIS Desktop (including Pro), and through extension, being able to download the data.