Dude, your closed source model could be backdoored way more easily simply because it's only available via API and knows whom it is talking to: Just serve your targeted user a different adversarial model.