I think he might be talking about the "relations" tab. You can see the "Contacted IP addresses" section that claims to be "contacted IPs by the file uploaded to virus total". If you click the IP some will have detections and flagged as bad or criminal.
Though haven't looked at how yt-dlp works, I'd guess yt-dlp might attempt to use tor network in case some IP or network is blocked and can't reach a server.