Daklon
I think is better to not use an standard port and using fail2ban at the same time to avoid automated attacks. If you manage to implent what you are looking for, you are potentially telling an stacker which accounts exist and which not, allowing him to do an easier brute force attack. A typical attacker using a botnet will not be stopped by a single IP being baned, and as son as an IP is banned he will know that this account doesn’t exists. Another option is enabling port knocking.
As far as i know, they don’t use the youtube api. Therefore they don’t have to be compilant with any api policy or tos. They just connect to YouTube like any browser do and then show that information(with modifications) on the invidious app.
Google can try to modify the code faster than the developers try to update the app since they expect the data to be in an specific format, but that’s all, they aren’t using the api… There is nothing to be closed.