Earlier quoted context omitted.
My understanding is that weights are normally stored as pickled python blobs, which means arbitrary code execution as they are unpickled.
If it's PyTorch, it can definitely contain and execute arbitrary code. One of the reasons I'm not a huge fan of PyTorch.
It isn't like a multi gigabyte game for example, where knowing if there is any malicious code could easily be a multi-month reverse engineering project to get to the answer of 'probably not, but we don't have time to check every byte with a fine tooth comb'