This is a great reminder that in AI systems, the "trust boundary" isn't the API call it's wherever executable behavior actually happens. Moving the trust_remote_code check to the dynamic module load site is the kind of architectural fix that addresses the root cause instead of patching individual bypasses.

One thing I'd add is that many production teams now treat model repositories much like software dependencies: internal mirrors, snapshot scanning, least-privilege inference environments, and behavioral monitoring during model loading. Those controls continue to provide value even when the next supply-chain issue isn't in diffusers.

We've seen the same principle come up repeatedly while helping teams productionize AI systems at IT Path Solutions: securing the model lifecycle is just as important as securing the application code around it. This article does a solid job explaining why.