Try out void, it’s pretty fire

Handbrake is a frontend to ffmpeg, so that’s also an option

Perhaps you could configure more than unbound service behind a loadbalancer. Each unbound instance is configured to use different upstream dns servers.

Double check if unbound doesn’t allow you to randomly hop between dns upstreams first, but the above solution should work if that’s unavailable atm.

Also introduces the possibility of DNS poisoning

Yes its possible 👍

Use:

forward-zone:
  forward-addr: 9.9.9.9@853#dns.quad9.net

Virustotal can scan APKs afaik

There was an antivirus that was caught running a bitcoin miner in the background tbf. If memory serves it was Norton?