While a video file could have been "crafted to exploit a vulnerability in the codec or media player" (from an answer of Polynomial), the video upload features on social media sites typically re-encode the video in a way that would remove such exploits.
Generally social media services provide videos as streams instead of downloads. Twitter does not have video download buttons nor "the necessary link in the html document". Instead, the video is provided in small (~150k video/mp4
) chunks from https://video.twimg.com/ext_tw_video/*/pu/vid/*/*/*/*.m4s
.
Software exists that can put these chunks together, allowing them to be saved as files. As it creates a completely new file it is less likely that any attempts to exploit a vulnerability in a codec or in a media player would survive. It is not entirely impossible, but very unlikely, and would require a highly advanced attack.