before safetensors, python pickles were used and definitely unsafe model deployments.

but its possible a open weights model could be trained to some kind of exfiltration behavior, but the science of LLMs seriously lag behind the programability