I was imagining through the flow of security aspects in my mind and this is when i thought the need of an Extension that supports File Scanning via security engines with realtime threat intelligence and its implementation should be primarily [maybe completely] at the Front-End/Client-Side.

Files Uploaded by Users at the Front-End/Client-Side via File Uploading Extensions are directly stored in the Server over the designated folder. Which means, If there is a file that is infected in any form, It would directly hit the server and supposedly [Important] to have a proper server-site/layer security, but then somehow, the file has been uploaded and then it was found as malicious, Yes there is certain security solutions which scan the upload(s) before it is even allowed to be stored but then still the reliance would be purely on the server-site/layer security [Refer Diagram below].
Upload >> Server Security
*Relying on Single Security Facility/Source, Directly hits the Server Security where it is solely being dependent to scan and then either isolate or totally remove.

Now, With the presence of a Dedicated Extension for Security Engines, It would add a layer in between where whenever a User attempts to upload any type of file via the File Uploading extensions, The file would then be scanned and if found malicious or suspected as malicious it would then be blocked from being uploaded [Refer Diagram below].
Upload>>Security Engine Scan>>Server Security
*Dual Security Facility/Source = Better, Requires pass-through of the security engine and the again checked by the Server Security.

This Extension should be dedicated for the use via Security Engines via API and other keys only. It could probably be named as "Upload Guard"/"Upload Shield"/ etc.

If there is any Extension Developer that woud like to contribute towards this idea, You may begin the development with:

Option 1 : Light Scan [via Hashes only].
This method involves in calculating the unique identifier [hash] from the uploaded file content such as the MD5, SHA-1, or SHA-256, rather than Direct file upload. It is quite limited in its detection as it analyses via Unique Identifier's rather than analysing the entire file but then for the Initial launch upon development this should be fine. However, this method has some advantages as well in terms of efficiency in scanning large files, requires lesser resources and could serve the result quicker and it is available for free [If i am not mistaken] via Virus Total Public API.

Could be further Extended with:

Option 2 : Detailed Scan [Full Scan].
This method involves comprehensive scanning where the files are scanned completely via the Security Engines but then it is less convinient to be implemented at the initial development and launching stage of the extension as this method requires more conditional logics to be implemented in handling such files that are found to be malicious consists of the evaluation for highly malicious and minorly marked as malicious files. In addition to that, This method requires a Premium Paid Version of Service within most of the Security Engines. Therefore, It is not suitable for now. However, This method is shared to provide a clear picture to any developer that would like to work on this development that where would be another option which would be this.

Major Aspects to be Considered:

1] Implementation of Validation Checks ~ The Need of a Mechanism [To Code] to Fetch the hash to VirusTotal via API.

2] Prevent Storage Options ~ The need of a Mechanism [To Code] to store the files in a temporary/empty [Non-Critical] folder followed by Conditional Check [If Clean = Store/If Malicious = Remove] to Prevent the file from being stored in the Critical Folders that are closely related to our Flarum Site operations.

3] Display Failure and Flag the Post ~ In the event of Maliciousness detected, The user would be notified that its Uploaded File has failed due to suspected as malicious, whereas, the Administrator would be able to see the post specifically [As it is flagged] together with short statistics such as how many security services detect it as malicious out of how many that had scanned [VirusTotal has quite a number of security service providers integrated to it].

Thread to be Continued [In a Reply] over this.

Kindly share your thoughts if this is a relevant and workable solution.