Edit: The information provided in this comment was based on a misinterpretation on my side. After checking again, I couldn't find any instances of it being exploited in reality.
Unfortunately, it seems it has indeed been exploited in the wild, and highly visited sites are prime targets for these kinds of exploits.
However, considering that uploading WebP images as files is supported right now, displaying them directly on pages as image might actually be a safer approach! as some users might open them in old image viewer programs!
But at least users would have a choice to do so or not, on the other hand, if they are displayed as image in pages and any user with a browser older than the mentioned date opens the page, and there's malware in the image, it will be executed without any warning.
Users with older browsers are not uncommon in some places, though you could argue it's their responsibility to update.
As a side note, I think this restrictions will be globally loosened in a few years, but a year or two, might be too fast.
I love the WebP format so much myself... it's a sad situation... ?
