Wouldn't the malware have to sit somewhere else anyways? .safetensor tensors aren't "executable", so malware wouldn't sit there. Unless the "malware" is some misbehavior of the model?