The parent CSP restrictions take precedence over the iframe's sandbox attribute. in this case, downloads will be blocked because the parent CSP does not allow allow downloads.
allow downloads