It's an extreme stretch to say that the model weights are a derivative work of the training data given the legal definition of "derivative work".
You think that a model that's capable of being prodded into producing an infringing output in addition to all the other non-infringing outputs it could produce is no different than a compression algorithm?
If I "process data" by doing a word count of a book, and then I publish the number of words in that book (not the words themself! Just a word count!) I haven't created a derivative work.
Processing data isn't automatically infringement.