The site isn’t hosting the file. Sure you can host your own FTP etc. But there is a lot of security risks and vulnerabilities that arise because of that. You can even host your own Magic wormhole. It’s under MIT license. Just have to open the ports Etc. It should however theoretically have a lot less attack surface than HTTP FTP and similar protocols. Nothing is invulnerable of course.