I noticed a new setting available at the tenant level in SharePoint Online called “DisallowInfectedFileDownload”; you can check thanks to the Get-SPOTenant PS command
The setting name is quite self explanatory 
– the idea is to block downloading any infected file from SharePoint Online.
For once I disagree with the default value set by Microsoft to $false; which means the download button is available even if the file has been infected
I strongly recommend to turn this setting to $true using the PowerShell command Set-SPOTenant -DisallowInfectedFileDownload $True