Hello Russell,
The file suspected on the client device could be a subject of ban to prevent further propagation of an attack. This could have been preconfigured, hence the file is already blocked. This operation prevents it from being read, written, or executed on devices in your organization. Copy and move operation is essentially write action.
https://learn.microsoft.com/en-us/defender-endpoint/advanced-features