There is still a risk of supply-chain attack. People give LLMs direct access to their entire infrastructure via tools, and never check the code produced. It's not difficult to steer an LLM during training so that they'd output malware only when prompted a certain way, and that wouldn't come up during the initial evaluation.

Personally I see no difference between China and America in terms of risks of them embedding "backdoors" so to speak, but I disagree when people claim that open-weight models are obviously safe just because they can be ran locally.

It is not a trivial challenge setting up model serving infra for ~1T or larger models, especially in a high reliability environment (e.g. your team is using it for work, or you're using it to power production apps). Sure, there are third party providers, although the quality and reliability of their inference varies.