I recommend waiting on our fix to land, we have a PR in progress:
https://github.com/discourse/discourse/pull/16150
It amends the behavior so:
- We do the blocklist checking on every hop in a redirect chain
- We introduce a new feature so any site can opt out of oneboxing by setting a customer header
This will resolve @dschaper issue and give us more flexibility in future.
Unfortunately going with no store would cast a way too wide net and catch too many false positives.