I saw this on my twitter feed this morning. They don't include the Giphy SDK. They act as a proxy and (ab)use range requests so they don't even see the size of the returned GIF. It's a really interesting read.

And that blog post is from 2017 so those measures have been in place for 2.5 years already.