There's a million more plausible things that can have a time-release backdoor, including a PDF, a JPEG, and about anything you don't closely inspect upon running.

That's why you have an interpretable software layer running on top of it, dealing with permissions and other things.

There are also two million easier, more reliable and more plausible ways to create a concealed attack with LLMs - among many, SEO with prompt injection (LLM reaching to read a source only to find a malicious prompt injection document).

Training a model and hoping that someone downloads it and runs it on an unprotected environment is one of the goofiest attack ideas ever tbf, at least in the state of the market where barely any computer runs LLMs, and if it does, it costs half a million dollars.