I mean, it can be run locally, so you don't necessarily have to trust it, unless there's been any model-as-a-vector CVE.

That hasn't happened yet, has it? Where running a model from HF directly compromises the machine as opposed to some breakout or exfil done by the model after the fact?

That said, if you're filing your taxes or have a 'real' ID, the government already has all pertinent information required to fuck you over either deliberately or via a leak, so...