“But a bug in how WhatsApp implements its so-called “View Once” feature in its browser-based web app allows any malicious recipient to display and save the picture and video, which should vanish immediately after being viewed.”
WhatsApp blocks screenshots of View Once photos on Android and iOS. Its web app lets any recipient display and save the same photo. Browser extensions that do it were already being promoted before Tal Be’ery reported the bug to Meta on August 26. Meta’s advice is to only send View Once messages to people you trust, which is the advice for sending any photo at all.