> To be honest I've noticed that links to specific images (i.imgur.com/blah.jpg) get rewritten once they hit some specific traffic-threshold.

I didn't realise they had a traffic-based condition that did this, too. Wow.

They've been pretty hostile with this sort of thing for a while. Look at this behaviour:

  # Mobile UA
  $ curl -v -H "Accept: text/html,application/xhtml+xml,applciation/xml;q=0.9,*/*;q=0.8" -H "User-Agent: Mozilla/5.0 (Android 10; Mobile; rv:68.0) Gecko/68.0 Firefox/68.0" https://i.imgur.com/6WAZZpN.jpg
  < HTTP/2 302 
  < retry-after: 0
  < location: https://m.imgur.com/6WAZZpN?r

  # Desktop UA
  $ curl -v -H "Accept: text/html,application/xhtml+xml,applciation/xml;q=0.9,*/*;q=0.8" -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0" https://i.imgur.com/6WAZZpN.jpg | file -
  < HTTP/2 200 
  < last-modified: Wed, 18 Sep 2019 20:45:26 GMT
  < etag: "21d323ddb1c1926ab0d7a5bb9786c996"
  < content-type: image/jpeg
  ...
  /dev/stdin: JPEG image data, baseline, precision 8, 2250x1500, components 3

Notice that they redirect mobile users to https://m.imgur.com/6WAZZpN?r. I've noticed they do this in order to serve them ads, encourage them to install their PUP on their device (as you mention) and break their ability to zoom on the image (the image embedded is thumbnail size).

They use UA sniffing to disguise this behaviour from technical users on desktop. They also detect if you're using curl and spoofing a mobile UA (which sends Accept: * / *), in which case this dark UX pattern is disabled.