The website has a little Perl script that does the download of the requested file, and checks the content. This does two things; only know file types are allowed, and this goes around CORS.

https://github.com/jscad/OpenJSCAD.org/blob/master/packages/web/remote.pl

I guess that supporting data URL would be possible, but there would have to be some similar checks for data type, etc.

But what is the difference of ...uri=data:... to this openscad.xyz link with model wrt security? In case you eval the uri= specified file (and that seems to be the case because the model gets rendered in browser) you break the same security rules ...
https://www.openjscad.xyz/?uri=https://stamm-wilbrandt.de/en/forum/JSCAD.minimal.js

The support of data URL contents is not trivia, especially if you expect the 'data' to be evaluated as a JavaScript module. That's kind of breaking every security rule in the book.

However, the support for DATA formats might be possible, such as supplying JSON contents. But that would be very limited.

I think the real solution would be allowing the require() to include modules from remote sites. There are many such requests (issues) for the same functionality.

If you have any ideas then let's discuss via the GitHub discussions. There may be a solution, as modern browsers have a lot of functionality.