Seems unlikely that the security team would be happy having both ffmpeg and libav in Debian, so a GR would be needed to override them.