Ideally it would just issue a
COPY (query) TO 'some bucket MD owns'
and provide the user with a pre-signed URL to download it from.