Why the heck don't they air-gap these things when they're testing them? The can download the models and training data from read-only sources, and use a data-diode to a allow external monitoring without risking egress of control.

It's not rocket surgery!