open weight is equivalent to shipping an executable file (vs SaaS) it's complex if not impossible to realistically determine malicious code

No, it is not.