Just go to your settings on WhatsApp, then go to ‘storage and data’; under it you can see the option of ‘media auto-download’ which beneath it you can also found options like photos, audio, video, documents and besides them is an option to on or off them.
I think this is the third or fourth time I've seen someone ask how they can avoid auto-downloading malicious files from the internet. I guess apps like WhatsApp or Telegram need to advertise their disabled media download more often, considering how many people don't look for that option on their own. I can understand if the user is a bit older and is not curious to try new things, but it's a surprise that youngsters also don't know about it.