They did this exact thing for csam detection a while back, and were made to stop due to public outcry.
It might have been analyzed locally and before encryption then though, still however without consent of the user and sending problematic results to apple.

It is very realistic that here they would make the device decrypt and check the description against a database and make it send the file and description off for reporting when a match is found.

They make you associate the device with a functional sim by forcing you to do the process over mobile data.
Presumably they take all the sims IDs, effectively making the limit 1 device per year per unique phone contract including data.
Going by my experiences with prepaid contracts (which got canceled due to low usage) I’d estimate that creates costs of 20€ per unlock in my region.

online via a mobile data connection no less, presumably to allow them to reliably associate the imei to you.

I cannot open that, it shows a login page. Could you post a screenshot of what this is supposed to contain?

Where is YouTube ReVanced?