> they can easily have functions that provide them the plaintext through a separate channel

That's why they provide cryptographic attestation that the open model they're running is exactly what they advertise without any modifications.

That combined with GPU confidential compute should protect your LLM prompt and output.