I wonder if a legal firm could setup a privately hosted LLM then claim attorney-client privilege as a rendered service.

Would a judge be able to demand the attorney hand over written notes from his clients?

I doubt it.