There is no hardcoded whitelist. It's all based on the browser user's use of websites. See chrome://media-engagement/
Your interactions influence the default list, minutely, but also only if it’s a popular site. The distortions remain.
Apologies if we have different definitions of hardcoding. I’m not suggesting this list is a compiler argument. Just saying that a Google list decides whether a domain can autopsy video, instead of a more open web approach like “HTTPS can do this”, which is used for many features like WebRTC.