That’s right. Unfortunately, the gallery filter is not like most where you could search/replace small elements of output. Output is all on you or all on WP, nothing in between.
There is an alternative if your gallery shortcode occurs in post content. You could hook “the_content” filter late, so that shortcodes have already been expanded, and search/replace the content. Typically, the gallery shortcode output is the majority, if not all, of content, so filtering content is little different from filtering gallery output, if it were in fact even possible.
There’s no risk of breaking things within WP itself after an update if you were to modify core files. This is because whatever you changed will be obliterated and reverted to the current version. However, any code in a plugin or theme that is dependent on your modification will be broken. The real risk in changing core files is people become reluctant to update because going back and reinserting their changes becomes a big PITA. Minor security updates can come rather frequently and they are the ones we should not delay in applying. Delaying updates introduces real security risks. What was once unknown becomes very well known, often with related exploits appearing in the wild.
You may tell yourself you’re willing to keep up with updates and religiously reapply your changes, but that’s not going to last. Been there, done that. (altered plugin code, not core) Of course, if your host is pushing updates, you have no choice in the matter. Altering core code is still not worth doing. It’s better to replicate 100 lines from core in your plugin than change 1 line in core itself.