I honestly think you could run a cryptominer on it and wouldn't be any worse than all the other shitware MS bloats it with

you can verify the sha256sum against MS official list

Where is this official list? A quick google search just returns forums which seem to conclude that these are no longer published by MS.

There are some dumps online like https://www.heidoc.net/php/myvsdump.php or https://sha1.rg-adguard.net/

The issue about verification still remains. We have no way of knowing if these haven't been tampered with as well. If a malicious actor is tampering with ISOs on a large scale, they will make sure their tampered copies have the most seeds and their fake checksum lists will be at the top of search results.

find a friend with MSDN access (or whatever it's called this week), the digests are all in there

(they used to be public)

The images(wim/esd format) are downloaded from Microsoft servers. There is no tampering.