Please note that this future will function via vrchat's website or vrchat support ticket.
So when the user logon to that site,he will be able to re-download own (future proofed enabled/disabled) uploaded content from vrchat.
This procedure is 100% legal
The only thing user shod keep in mind,is that he must never share his account information to anyone. In this way there will not be any problems with the TOS.
And to be honest, i'm very surprised why vrchat didn't do anything about this to make it happen.
is this because the users will be able to download paid content that is uploaded to them?(although this may be possible in the future so when the user ONLY give own username to the creator, The creator will be able to send pay'd content to that user).
in this case user will be able to abuse this future,and download something that is sent to his account?
Well this will not be a problem because,the vrchat will make separate API's for users who upload their own content and the content that is sent to a user. The first API will be unlocked but second will be locked. In this way the user will only be able to download what he uploads,but not something that is sent to him