Security PSA for all those playing VRChat:
Make your NSFW avatars private unless you want someone to embarrass you, or to get banned, even if you don't have avatar cloning on when using them.
Any public avatar is easily yoinkable through the API.