@Hermann-SW Good questions...
The website has a little Perl script that does the download of the requested file, and checks the content. This does two things; only know file types are allowed, and this goes around CORS.
https://github.com/jscad/OpenJSCAD.org/blob/master/packages/web/remote.pl
I guess that supporting data URL would be possible, but there would have to be some similar checks for data type, etc.