Isn't it safe to assume that no video file can escape the browser decoding sandbox?

It's 'safe to assume' it's not. It's emphatically not safe to assume any mitigation is perfect.