What's so concerning about the Hugging Face hack?

Audio is streamed directly from the publisher (pscrb.fm) as published in their RSS feed. Play Podcasts does not host this file. Rights-holders can request removal through the copyright & takedown page.