Without talking about the resources it would require, youtube could totally only serve the ad until it has been “watched”. And no amount of sponsor block or similar software would help. These software only work because youtube allow you to navigate the video. If they decide that you have to fully download a 30s ad video, and that you can’t ask for the video for the first 30s, then you wouldn’t be able to do anything (or at the very max, just hide the ad and wait 30s on a blank screen).

https://programming.dev/comment/2512899 :)

Well, to be honest if someone has access to my Wi-Fi, I’d consider that I’ve already lost. As soon as you’re on my lan, you have access to a ton of things. With this setup I’m not trying to protect against local attacks, but from breaches coming from the internet

I’m not well versed in ARP spoofing attack and I’ll dig around, but assuming the attacker gets access to a “public” VM, its only network adapter is linked to the openwrt router that has 3 separated zones (home lan, home automation, dmz). So I don’t think he could have any impact on the lan? No lan traffic is ever going through the openwrt router.