Simply decentralize it. When running locally, user will be able to attack only their own machine. But since we're doing everything to deprecate such way of computing and have everything in cloud for a decade....
I believe that's the OP's point. Copy-pasting some text from a site into a private LLM is very easy (and fun) to do when exploring the text. When framed as "executing arbitrary code", the implications become clear. But a lot of people won't realise this until some damage has been done.