Comment by regularfry

Either

1) the company has device-level control to the degree that they can not only restrict which API endpoints people can connect to but which accounts they use to do so (in which case this already isn't an issue); or

2) they don't, and all bets are off anyway, open weights or not.