As long as thinking blocks can't make tool calls, I don't really see the exfiltration risk.