It is. Not per sé because the code might be of poor quality, but because someone sent that source code to a public API under the promise that oh noooo we won't use your code for training. Probably.
That's what I mean with the promise. Nobody knows what they're doing on their end. The data goes over the wire, and then you need to assume they are true to their word and the data is not intercepted by anyone.
obviously you need to review it