The worry is direct exfiltration, not training