It's an exploit path to a UEFI bootkit, so at the very least you'd have to throw your motherboard away or find someone that can physically overwrite it through an external flash programmer or something. And the patch should be delivered through a UEFI firmware update, so if your motherboard is no longer supported you would have to buy a new one. And for laptops and embedded devices having everything soldered in, the motherboard is basically the whole computer, so I don't think it's that much of an exaggeration.
I guess it's true that if you have ring 0 access you're boned, bug if your ring 0 access gets upgraded into ring -2 access you are even more boned. They put those security boundaries in place for a reason after all.
From what I understand, the end of the URL string is just one of the clues the browser uses to determine the "type" of received data (https://mimesniff.spec.whatwg.org/), and the true behavior depends on the browser's specific implementation. A part of the process involves actually reading and analyzing a small portion of the received file to see if the file really is the type that the URL claims it is. For example, I started a quick python server, and made it serve the OP image, except I renamed it as a jpg file (without actually converting the image of course). When saving the picture inside the browser, Firefox correctly identifies the file as a png image:
While edge incorrectly tries to save the image as a jpg image:
![](https://lemmy.world/pictrs/image/0c4a5d54-fbd2-45cf-a7e5-5a5b8b0d59a9.png)
Regarding your "MP3" file specifically, opening it in a hex editor reveals that the actual file contents identifies itself as an M4A file, despite what the URL claims:![](https://lemmy.world/pictrs/image/b03a80c1-e501-49cc-bac7-9eef76e1e576.png)
So, you should be good to download them any way you find convenient, and then just renaming them to the proper extension afterwards.