Carefully.

Seriously, I don’t know of any/many issues caused by downloading and playing a legitimate video file (MP4/MKV/AVI).

I feel like, if there are, those are being saved for a nation state level attack and not Fred downloading Shrek 2 questionably.

So long as you are careful about file formats you shouldn't have any issues, but there are a decent amount of measures you can take.

1. Do all your downloads inside a VM that is sandboxed away from your main system, and then monitor the system processes when you run the file. 1.1 if you really want to isolate it watch things on that VM, but that's a bit of a pain
2. Have your download system on a vlan that isolates it from the rest of your network.
3. Only download from well trusted communities and make sure to verify checksums.
4. With a little bit of time to kill you can learn how to run a sandboxed video player on Linux or could go the extra mile and run a system like nixos which is isolated by design

It doesn't have to do with device security, but you should only do downloads over a VPN with a kill switch enabled to stop your ISP from sending you a cease and desist letter. Keep in mind that you are just trading your ISP for your VPN server when you do that though, so you may want to pick one that has been proven to not record logs, I use PIA for that reason, but I have also heard that mullvad also got subpoenad and demonstrated that they didn't hold logs.