Transport rules in Hybrid, what's wrong?

Question

Microsoft Exchange

Hello,

tell me what could be the matter: there is a hybrid configuration of Exchange server 2016, connection via Express Route.
The same Transport rules on both sides with the prohibition of sending certain types of files. There is a rule for marking letters that come from outside.
DLP in the cloud is disabled.

Now the case:
I send a banned file in a zip archive from the cloud to on-prem, I get NDR 5.7.1 This Message Contains a Banned Attachment Type. Remote Server returned '550 5.7.1 TRANSPORT.RULES.RejectMessage; the message was rejected by organization policy' from a server in the cloud.
I forward the same file to a box in the cloud, the same NDR 5.7.1

I.e. Transport rules work.

Ok, I'm sending a dump file in a zip archive according to the same scenario: from the cloud to on-prem. And I get the same NDR 5.7.1, but from the on-prem server (why is that?!)
And the Tracking log in the cloud says that the letter was delivered. And the respondent, of course, received nothing.

The last step: I send the dump in the archive to a box in the cloud, and the letter goes through!

What can be wrong? The rules are the same on both sides, why are the results different?

Thank you.