As for the AIP client I don’t know the technicals details on how it’s protected , but for the Information rights management in Sharepoint , the file will be encrypted on download and office apps will handle the decryption and making sure every 10 days you are able to login (have valid credentials) and won’t open if you don’t. It’s still possible to open the files , copy and paste on an unprotected file and save it on external storage and it will always be accessible, but this would mean a lot of work and most office users wouldn’t know they needed to do it.