To access and export encrypted files, the user performing the search/export must be assigned the RMS Decrypt role, which happens by default for the eDiscovery Manager role group within Microsoft 365.