Earlier quoted context omitted.
My understanding is that weights are normally stored as pickled python blobs, which means arbitrary code execution as they are unpickled.
If it's PyTorch, it can definitely contain and execute arbitrary code. One of the reasons I'm not a huge fan of PyTorch.
Some solutions for checking: https://huggingface.co/docs/hub/security-pickle
or run them in an isolated env.