Discovering and downloading (or streaming) blobs from other servers isn't part of the blossom spec but its something I added to my blossom-server implementation
By default the example config has it setup to check cdn.satellite.earth and nostr 1063 events to find blobs, but if you want you can turn it off in the config https://github.com/hzrd149/blossom-server/blob/master/config.example.yml#L15-L30

I don't know if there are any security implications of downloading a blob. but its possible an attacker could flood a server by asking it to download everything from another server 

 
This feature definitely makes sense, but requires more security. For example, a signed event would be required to allow files to be discovered and saved through other servers. 

 Aaa I see my bad, i was thinking that was part of the spec 😅