So if a user can bring an LLM to output a copy of some training data, then the ones who distribute the LLM are engaging in illegal activity?

It isn't illegal as a LLM model is transformative.