And in what way is this stealing? Caching a publicly available asset? Sounds like you are saving Google bandwidth/money.

I think the point is that they’re avoiding whitelisting Google and Github domains which is necessary to preprocess images from and use urls to images to their domain in an Image tag. That allows malicious users to send urls such urls to his _next image preprocess endpoint and get “free compute”. (Not sure why someone would do that other than to just screw with somebody).

He’s using BetterAuth hooks to fetch those images and upload to his trusted url to avoid such a scenario.

Loading an img tag doesn't involve trusting a domain. Especially using crossorigin and refererpolicy attributes.