So long as you are careful about file formats you shouldn’t have any issues, but there are a decent amount of measures you can take.

1. Do all your downloads inside a VM that is sandboxed away from your main system, and then monitor the system processes when you run the file. 1.1 if you really want to isolate it watch things on that VM, but that’s a bit of a pain
2. Have your download system on a vlan that isolates it from the rest of your network.
3. Only download from well trusted communities and make sure to verify checksums.
4. With a little bit of time to kill you can learn how to run a sandboxed video player on Linux or could go the extra mile and run a system like nixos which is isolated by design

It doesn’t have to do with device security, but you should only do downloads over a VPN with a kill switch enabled to stop your ISP from sending you a cease and desist letter. Keep in mind that you are just trading your ISP for your VPN server when you do that though, so you may want to pick one that has been proven to not record logs, I use PIA for that reason, but I have also heard that mullvad also got subpoenad and demonstrated that they didn’t hold logs.

I assumed that they didn’t have old hardware lying around, in which case they are not incorrect as they will need at the very least 8gb to run the server effectively which by itself is approx $100 unless your looking at the second hand market.

I’ve been saying for years, water makes things wet, so one molecule of water is not wet, but once you have more than 1 the collection of them becomes wet.

I don’t know about the launcher, but I do know the that all storage is wiped in the process of switching over.

Discounting some minor comparability issues, the process just requires a computer, an internet connection, a cable, and the ability to read through a couple paragraphs of instruction.