While anyone can perform the attack described in the bug, it takes a very sophisticated attacker to craft the payload that can exploit Android’s media library.

But media files that exploit parsers is the bigger issue. Errors in parsing have allowed for code execution, etc, in whatever context the parser runs; look into Stagefright and the many similar exploits before and after. Accepting media files from anywhere without user interaction is pretty risky. WhatsApp has a media file sanitizer, but it may not catch everything.

Disclosure: I worked at WhatsApp until 2019; but not on the media file sanitizer.