There is an issue in Canvas where files that are unpublished or restricted by time appear as available in Student View. Actual students would not see the file, the issue is with Student View itself.
When the file is locked or restricted, and added to a page, that file appears to be available in Student View. Canvas has stated that it's a browser issue. What's happening is the browser is caching the access to that file. If a teacher clicks the link in regular view (not student view), the file will be available as expected. However if they go into student view and click on the same link, the browser has cached the access to the file and will download the file regardless of student restrictions.
This should be fixed. Student View should mean Student View, no exceptions. If a teacher sees this happen, they will rightly assume that the students can actually access a file that should not be available to them. The teacher will assume that Canvas is not working as expected, they will probably not assume a caching issue with their browser.
There is a second scenario, where the teacher has never clicked on the file before going into student view. In this scenario the browser has never cached access to the file. If the teacher then goes into student view and clicks the link, they will get the "file is restricted" message as expected. If however the teacher clicks "Leave Student View" on this page, the locked file will download (see screen shot of this happening). After the file downloads the "Leave Student View" button does not work, and the teacher must click somewhere else to actually leave student view. This is bizarre and should be considered a bug.