For the curious, here is a follow-up on the scammer who pretended to be from the Kdenlive team. (Email posted yesterday, I'm replying to it ↑).
Confirmed: it's a scam and their goal is to get the target to install malware.
Here's the whole discussion as screenshot, and it wasn't easy because I had to use an old inactive Gmail account 🤢. That's because Protonmail is banned from this impersonator's email address, kdenlivevideo.site (handled by emx.mail.ru).
I won't dig any further.