Where it gets fiddly is if the model is capable of spitting out close reproductions of images from its training set. That's been demonstrated on some models. I don't have a particularly good intuition as to which way this would go, but I can see someone making an argument that copying the model is therefore copying all the training set images it could be convinced to make a reproduction of. That's unlikely to be everything in the training set, but by the same token I don't know how you could determine how much of the training set can be reproduced that way.
Except where they kind of are.
Where it gets fiddly is if the model is capable of spitting out close reproductions of images from its training set. That's been demonstrated on some models. I don't have a particularly good intuition as to which way this would go, but I can see someone making an argument that copying the model is therefore copying all the training set images it could be convinced to make a reproduction of. That's unlikely to be everything in the training set, but by the same token I don't know how you could determine how much of the training set can be reproduced that way.