In the same way as is done for other images?
See this onebox:
The URL of the image of the bonfire is:
It was download by Discourse from the original site at this URL:
https://www.thenews.coop/wp-content/uploads/D6eFNECXkAM9BmG-1280x600.jpg
All I’m asking is, would it make sense to treat favicons in the same way that other images are — download copies and serve them locally?
Test the current behaviour yourself, enable “Hotlink Protection” on a site behind Cloudflare and you will find that Discourse still downloads the main images for oneboxes…