Assuming the providers are compromised (and I agree that some of them probably are) then I doubt the angle taken will be to poison the product. That kind of thing usually gets noticed eventually.

A more likely scenario is to focus on the model users as potential victims, e.g. by logging internal infrastructure descriptions, capturing private access tokens from chats, etc. That is very deniable, because it's hard to prove where the compromised data originated.

Of course, I'm not claiming PRC is a friend of the world. And I agree with your last point, however I don't think it's feasible to self-host Kimi-3 sized inference.

Self-hosted local models can't become viable soon enough... Currently they require hundreds of thousands of dollars if not millions in capital. That needs to change!