Yeah, there are a lot of legacy pickles and even some recent stuff in pickle format.

The way their system is designed it’s built to try and push you away from just downloading a safetensors file and make the installation of a model seem more elaborate than just doing that and in some areas safetensors support trailed unsafe model support.

But overall if you know what you’re doing you can use safetensors with HF. Just strange the unsafe option is still offered at all when the download local files side of AI have moved over to safetensors fully.