https://localsend.org/

…or just spin up a local fileserver with Caddy (in case you can’t install Localsend on a specific device)

friend should nuke this crapware and use syncthing for such activities. if they happen to run jellyfin, they can use it to serve books as well, and by utilising the OPDS plugin it would allow compatible readers (e.g. Librera) to directly download books/comics to the device in a shop-like interface.

Your friend should find a better, more lazy way to transfer files. People have commented about some and there is lots more.

I’d bet they’re going after the big group chats of people sharing illegal material, not so much private chats.

Governments won’t see your friend’s private messages and thus not request IPs. They’re fine.

They’re targeting people selling stolen credit cards and drugs, who are advertising on telegram. Your friend (SWIM?) is fine.