Is it possible? Yes.
Is it common? No.

As long as the weights are not malicious, local is completely safe. There is no phone home or anything like that.

It is possible to embed malicious intent into weights, you can even build weights into other weights that only activate under a trigger phrase.