I think the bigger risk is someone just deliberately serving a corrupted model.

e.g. Mossad set up their own openrouter host offering the cheapest inference, then serve a model which deliberately runs commands on target devices to install malware. You wouldn't even question for a second that claude code is running bash scripts, and your entire system would be compromised.