I’d like all post galleries to act as though they were all set to open as ‘media’

Is this possible? A kind of overwrite function?

I’d think it would be easier to search/replace all the shortcode link attributes, but that’s just me ??

add_filter( 'post_gallery', 'my_get_gallery_shortcode', 10, 2 );
function my_get_gallery_shortcode( $output, $attr ) {
  // insert modified source for gallery_shortcode() here
}

You must remove the “post_gallery” filter application from your version of source or you will invoke an infinite loop. Edit the applicable $atts['link'] portion to achieve your desired effect. The source is in wp-includes/media.php starting around line 1631. The link attribute portion is around line 1776. There may be other portions you don’t need, but regardless, you end up with a lot of code. Producing a somewhat flexible gallery output takes some doing.

If I’m editing many files in source, like /media, will that pose a great risk of WordPress erros (breaking things) when my hosting provider automatically force updates my WordPress?

There is an alternative if your gallery shortcode occurs in post content. You could hook “the_content” filter late, so that shortcodes have already been expanded, and search/replace the content. Typically, the gallery shortcode output is the majority, if not all, of content, so filtering content is little different from filtering gallery output, if it were in fact even possible.

There’s no risk of breaking things within WP itself after an update if you were to modify core files. This is because whatever you changed will be obliterated and reverted to the current version. However, any code in a plugin or theme that is dependent on your modification will be broken. The real risk in changing core files is people become reluctant to update because going back and reinserting their changes becomes a big PITA. Minor security updates can come rather frequently and they are the ones we should not delay in applying. Delaying updates introduces real security risks. What was once unknown becomes very well known, often with related exploits appearing in the wild.

You may tell yourself you’re willing to keep up with updates and religiously reapply your changes, but that’s not going to last. Been there, done that. (altered plugin code, not core) Of course, if your host is pushing updates, you have no choice in the matter. Altering core code is still not worth doing. It’s better to replicate 100 lines from core in your plugin than change 1 line in core itself.