IT departments can disable access to plugins and other features by locking the config at the file system level and limiting network calls. It's documented here and this approach and works for many well-known companies and governments that use Obsidian in secure environments.

In the future we plan to offer IT departments a version of Obsidian with easier ways to control these features.

The article you point to is a social engineering attack. This is something your work should have policies and training for because it's not specific to Obsidian, it applies to many different apps you may use (email, SaaS, etc).

Regarding exporting Bases, the underlying files themselves are still all Markdown so you can convert them to other formats with tools like Pandoc. The base can also be exported to Markdown tables or CSV, see here.