These IPAs are not hosted on Apple’s servers. They come from anonymous uploaders on Mediafire, Google Drive, or Telegram. A "Hot" IPA can easily contain keyloggers, adware that drains your battery, or spyware that reads your clipboard (passwords). Since you are sideloading, Apple’s security checks are bypassed.
For most users, the reliable solution remains the official subscription or the ad-supported version. The "hot" IPA might provide temporary gratification, but the long-term cost to device security and user privacy is a price many eventually regret paying.