This is what I do too. If i need to use or test something i don't trust then I use an old phone. All of the phones use crDroid(1) and I have scripts to quickly wipe and reinstall the OS whenever I need a full nuke.
I used this a while back while running a waybackmachine style site for a large social media platform. I wanted to keep it simple with sqlite but when it got popular it started to become a problem. Marmot was the only thing that I was able to get to work with the amount of data I was pulling in. It would sync the master db from the main archiver server to all the ha servers so the user would be able to access it immediately no matter what ha server they got. The dev team was nice to talk to when I had some issues in setting it up.
It was definitively a weird backend setup I had made but it just worked once set up so I didnt have to touch any of the frontend code.
The URL scanner doesnt directly scan the file. It checks the URL against other web firewalls and returns stuff like the headers, chain, the sha256 hash of the body (which links to the actual file analysis https://www.virustotal.com/gui/url/9525d0fe32cebf7933bf84dcf...)
You can see and compare the different vendors of each. File analysis goes to all the antivirus' and does the sandbox stuff and the URL analysis goes to things like Google Safebrowsing, phishing check services, etc
tldr different systems for URL analysis (web firewall check) & file analysis (antivirus/sandbox check)
Where do you get 14k from? The chrome store says 4 million users and firefox says 400k. And an unknown amount of users using the many modded mobile youtube clients that have it builtin.
I think the youtube algo just serves you what it thinks will get you engaged (hate watching?). In the past I've gotten both right and left extremist content. I eventually set my youtube settings to delete everything that is older than 3 months, my feed has been way more usable since I did that. That plus using revanced to remove all the stupid shorts and news/promo sections from the app.
Specific to Flickr URLs, its the '_d' at the end. Remove it and you can view it normally in the browser. But as danielbln wrote, that 'Content-Disposition' header is what forces a download in general.
(1) https://crdroid.net/