Hi sam20e.
First I should point out the I am not a Norton Employee (as you are probably aware, they appear with bold red names) and so cannot be sure how the software works behind the scenes. Next I would say that I believe that on an Android device/phone such software probably works slightly differently from the usual Windows environment software - they are different environments with differing issues and threats.
That said, as far as I am aware, NMS only scans items when they are downloaded if they are executable and are then installed (e.g. apps from Google Play). Otherwise it waits for the pre-scheduled scan to scan the phone and, if you choose, the micro SD card as well. So in your case as the attached file is not an executable you would have to wait for a scheduled scan or tell it to conduct one before it actually checked the download, it would not automatically check it as it was downloaded.
Does that help? If I have not been clear enough please feel free to come back.
