Currently, Sync's default permissions for site members can be restricted to the following four options via the Sync Connector control panel app:
1) View Only
2) View and Add Discussion
3) View, Update, and Add Discussion
4) View, Update, Add Discussion, and Delete
Restricting users to "download/read only" is equivalent to setting "View Only". However, view permissions is always considered inclusive if you have update/delete permissions.
There are cases where admins may want to restrict permissions to upload/update only. As there are numerous possible configurations (upload only, upload + update only, update + delete only, etc), one option is to set zero permissions for site members. Then admins have the flexibility to define custom roles for users.