Building a project under the downloads folder is not very safe. This is because of things like Directory.Build.props, which mean that you need to trust all of the parent folders of your source code up to the root. Most browsers will download files to the downloads folder with no additional confirmation when you click a link, so a malicious link could put a Directory.Build.props file in your downloads folder, and then execute code in your build when you subsequently built a project that had been downloaded (or extracted) under the downloads folder.

We should probably fail outright, or at least warn, when trying to build a project under the Downloads folder.

This probably makes sense to be an MSBuild feature. Possibly it should be a BuildCheck, but maybe it should just be built into MSBuild by default before it even tries to start the build.