How is this any different from hotlinking an image? I don't understand the security risk here? If a bad actor gets control of the domain all they can do is chan

How is this any different from hotlinking an image? I don't understand the security risk here? If a bad actor gets control of the domain all they can do is change the svg that you render. I suppose you could parse that SVG in an insecure way (if for some reason you were parsing it) but that's not a problem with using the service.