I'm not sure how you can make this argument just based on the model synthezing a watermark that is has learned about in the original dataset. Don't forget, the model is only 4GB in size, and while it's not out of the question that it could regurgitate an image from its data set, considering the size of the training which is a few magnitudes larger it is highly unlikely.