“I have found a working IDOR (Insecure Direct Object Reference) bug, where I could get a frame from any private video on YouTube!”
Private on YouTube meant private on YouTube. Google Ads had its own path to the same videos and never checked who owned them. Pull enough frames and you get a silent copy of the whole thing. Google paid $5,000 and switched the feature off until it learned to check permissions.