Shared Files from Unprotected Drives
In Google Drive and Office 365 SharePoint/OneDrive, files displayed in the Shared with me section are only references to files that other users shared with the user. The actual file remains stored in the owner's Google Drive, OneDrive, or SharePoint site.
If the owner's Google Drive, One Drive, or SharePoint site is not protected by the Email Security policy, the file is not automatically covered. This applies even when the file appears under a protected user's Shared with me view.