The restricted loader stops at any import not on its list. The widget shows what Python’s loader would do with the bytes; it only reads them and writes words, and runs nothing itself.
The raw bytes of each file, in hexadecimal. The bytes of the current step are outlined.
Real model files hold millions or billions of numbers, not six. PyTorch’s weights-only loader is a separate unpickler, and its notes say you can add types to its allowed list. This file names one function and it is harmless; a file from a stranger could name any function Python can import. A real safetensors reader checks more than this one shows: offsets in range, no overlaps, no holes.