I think that the argument is that an hostile model could attack overseas datacenters, host itself there and then launch its attack from there.
Given that the models have been proactively hacking other companies, why does it matter where the code currently is? It could move to any of them.
Not the code: the weights. Are you going to host a trillion parameter model somewhere without someone noticing?
It's not unthinkable, do you think all cloud providers with sufficient compute have perfect monitoring?
Cloud providers want to make sure they bill someone for every microsecond of compute, particularly GPU compute which is in demand. They constantly work towards good monitoring because their profits are directly on the line.
I’m sure a super AI can find/scam enough money to pay its own bills under the cover of doing something legitimate.