I believe the google framework is installed with less privilege than a system application

I was under the impression you could use microG instead of google services as well if you installed it manually?

Handbrake is a frontend to ffmpeg, so that’s also an option

Perhaps you could configure more than unbound service behind a loadbalancer. Each unbound instance is configured to use different upstream dns servers.

Double check if unbound doesn’t allow you to randomly hop between dns upstreams first, but the above solution should work if that’s unavailable atm.

Also introduces the possibility of DNS poisoning

Yes its possible 👍

Use:

forward-zone:
  forward-addr: 9.9.9.9@853#dns.quad9.net

It does, but skipping requires plex pass which is a paid feature

Still better than nothing

There was an antivirus that was caught running a bitcoin miner in the background tbf. If memory serves it was Norton?