IANAL either, but there are attacks you can use to extract the original training data from the models: https://arxiv.org/abs/2301.13188. I’d guess these attacks will get better with time.

So in some ways, you can argue that Stability is also directly redistributing the original images (albeit in a compressed format).