A downloaded machine-learning model might look like a file full of numbers. In the Python pickle format, the file can also tell the loader what objects to create and which functions to call. That makes it possible for a malicious file to run code when someone loads it.
Hugging Face's documentation describes how the Hub inspects uploaded pickle files for imports and shows the scan results. An import is a reference to code from another module. Looking for unexpected imports helps identify some files that could do more than restore model data.
A scan has a defined job
The Hub describes its lists of safe and unsafe imports as best-effort. A file that produces no warning has passed the scanner's checks. That alone does not establish what every loader or imported package could do.
The difference starts with the file format and the program that reads it. Two files can both be described as model weights while giving their loaders very different powers.