Yes. You get the model from HF? HF could've edited the weights.
You use an unsloth quant? Unsloth could've edited the weights.
You create a quant yourself? Your version of llama.cpp could've edited the weights.
And then yeah, as you say, the actual inference engine itself, the firmware, even the hardware.
Untrusted is untrusted, abliterated AI or otherwise.
it's the same "trusted compiler" argument, only at a different level. Though at least here you could -- if you wanted -- check the generated source.