How can I prevent users from downloading my plugin files from my sandboxes (or adding their own)?

By default, sandbox users can install a plugin like this one that allows them to download your plugin from your demo sandbox.

The best way to prevent this is to prevent users from adding or modifying plugins in your sandbox. 

Does WP Sandbox give you the option to disable plugins from being added or changed? No, but there are a couple of ways you can disable plugin modification in your sandbox sites.

The easiest way to disable the Plugins WordPress menu option is using the Admin Menu Editor plugin. Admin Menu Editor allows you to choose admin menu items to show and hide. With Admin Menu Editor, you can choose to simply hide the menu item, or go a step further to actually disable it so users can't get to it through workarounds.

There are other plugins that can do this, too, just be sure you choose one that will prevent users from accessing those features using workarounds like direct address bar manipulation.

Another option is custom programming. It's fairly straightforward to disable admin features programmatically, effectively disabling a user's ability to add or browse plugins, but be careful. Doing this manually can cause headaches down the road.

Hope this helps!