Doesn't node's fetch call the decoder automatically for `br` responses? So any attacker controlled content that a server fetch's may be vulnerable?