It could even happen with local models where in the weights it will make it want to make a tool call to curl some endpoint.
Models generate text, or I should say provide a recipe for generating text, they don’t automatically somehow get access to shell commands.
Safetensors don't execute code. A call would need function calling, as other comment say, it would quickly be noticed.
People would both notice that and have a pretty easy time putting a local model in a sandbox that can never contact that endpoint.