Makes sense. Though if one wants security maybe it's better to use something like PhotoSync to copy the photos through FTP/anything and mount the volume RO.
Firstly connections to those API should be encrypted, so parameters such as the filename shouldn't be visible by a MitM. Also, as someone else pointed, you could rename the file beforehand to something neutral.
His problem isn't the part where he downloads parts. Jellyfin queries 3rd party metadata providers, such as TMDB. What he's concerned with is JF sending the filename to TMDB and getting spied on by the ISP.
Indeed, idk anything about the graphical capabilities of the PS3/X360 emulators tbh, so idk if the Switch can be similar to native PS3 🤷