A plugin can spawn arbitrary processes so if neovim is not started in a sandbox (container, namespace, firejail...) they can basically do whatever your user has the right to do.
If you want your content to be accessible for most people you also need to transcode your video to several resolutions. This coupled with an adaptive bitrate player [0][1] will allow clients to choose the resolution they can afford (so that people with different bandwidth can access your content)
When dealing with more than 10s or 100s concurrent viewers the required bandwidth on your server will be high and putting a CDN in front may be required.
Pretty big supply chain risks here.