It means that they don't know what they're talking about. A "downloader" refers to part of an exploit payload (or other malware) that downloads additional code

It means that they don't know what they're talking about. A "downloader" refers to part of an exploit payload (or other malware) that downloads additional code. But an attacker can only use a downloader after triggering an exploit and getting code execution. If they're right about there being an exploit related to the video, it would presumably be in the video file itself; otherwise there would be no need to send an irrelevant video. But in that case, the exploit couldn't have been used to download the video in the first place. And why would you need to use some special code to download a video attachment, when that's presumably part of WhatsApp's builtin functionality? Also, even if there was a downloader involved, it would be, as the name suggests, the thing that does the downloading – not the thing that was downloaded. Whether or not there was an exploit, it seems almost certain that WhatsApp automatically downloaded the video like any other attachment, and the encryption was WhatsApp's own end-to-end encryption. Indeed, the report itself cites WhatsApp's end-to-end encryption in point 22, so it seems like they should be aware of that. Maybe they just don't know what "downloader" means, or maybe their ignorance is deeper; I can't really tell.