Url is a common place to modify behavior, but this is the domain name, something that doesn't get hacked because the domain name conveys trust.
Thank you for taking time to check this out. Points raised by you are valid. We are trying to give this as a quick solution for people who don't want to install an app or a browser plugin.
Alternatively,
https://volcano.live/embed/home is the page where you can insert links to start the Volcano co-watch for Youtube, Twitch & Vimeo videos.
https://vlca.no/chrome is the chrome plugin where you can do all the above just with click.