Currently only the “Main Download Button” seems to be protected.
So when the bundle contents are listed, these Single File Download buttons are not protected. This means I can just download without the popup to appear.
It would make more sense that all downloads (bundle or single) are treated the same way regarding the lock. From my point of view there is now advantage to have no lock on the Single File Download of the bundle, while the bundle is locked. Either I lock all or none.