By default the example config has it setup to check cdn.satellite.earth and nostr 1063 events to find blobs, but if you want you can turn it off in the config https://github.com/hzrd149/blossom-server/blob/master/config.example.yml#L15-L30

I don't know if there are any security implications of downloading a blob. but its possible an attacker could flood a server by asking it to download everything from another server