You are kind of hitting on one of the issues I see. The model and the works created by the model may b considered two separate things. The model itself may not be infringing in of itself. It's not actually substantially similar to any of the individual training data. I don't think anyone can point to part of it and say this is a copy of a given work. But the model may be able to create works that are infringing.