Either I have wrong mental model or then too many other people have wrong mental model.

For LLM to self-replicated it would need to first hack itself. Or the platform it runs on it. That is fully extract the model and then upload it to be run somewhere else.

As I have understood how they work is that you have LLM interference running somewhere with loaded model. And you input data there and then read outputs. Then some code runs that output and inputs following output from running it.

Meaning that to self replicate actually just running that output somewhere else is not enough. You need to lift the whole model to run somewhere else too...