Not all PDF viewers enforce these security policies, unfortunately. Adobe applications will, but some third-party ones might not.
You're actually warned about this when you first apply a security policy in Acrobat...
Yes it works somewhat on Internet Explore although it's still downloadable, but not at all on Firefox.
Is that the norm. So the security feature really doesn't work if the work arounds are that easy.
Unfortunately, that is currently the norm, yes. You should complain to Firefox and ask them to implement this feature the way it was meant to be implemented. It's out of the hands of Adobe.
This is why you get a warning that third party programs may not respect the security settings. Most people just click "Do not show this message again" as if it said nothing important.