It’s reasonable to be annoyed by this.

I’ve built automatic tools within client software that handle file types and basic security better than this, < 5 years into my career as an inexperienced dev.

It’s crazy that not only is executable downloading not blocked by default for a media downloader, but as fast as I can tell it’s not even doing magic bytes based format detection…?