Hi Paul,
Can you share the OML. I tried and this works for me in reactive.
This logic flow gives me a password protected excel along with a new sheet.

I suspect that you might be passing the object directly to these component's action. Try passing Workbook_Open action's output to WorkBook_AddSheet action and then use Workbook_GetBinaryData to pass binary data to the download widget.
Can find implementation inside this server action in the attached OML.
Thanks