At this point, and given how close SotA hidden ("closed") weights models are to downloadable ("open") weights models, I kinda have to assume some system somewhere is running purely because the model itself hacked (or blackmailed, they're not above that) its way into getting a server and uploaded some weights to that server.