The model is. How it is packaged is a different matter entirely. There is a good reason we saw a shift towards the safetensors format.

https://arjancodes.com/blog/python-pickle-module-security-ri...