The professional way to handle a rigging file is for the VTuber to seek consent from the original rigger and specify who this file should be shared with. The original rigger will directly share the file with the new rigger with a set of rules including privacy terms or an NDA to protect their work especially if you want the file to remain private. The source model file shouldn't just be handed out to every rigger out there, trust me, some riggers who I have shared my files with before used the files for their own benefit and without my consent AND they made profit off of it. You as a VTuber have no experience or understanding of the rigging file value so you need to be cautious and set up a proper protected process.