No, there are no issues in this particular case, because all resources used by Krita's generative AI are safetensors from trusted sources. Safetensors are also a much safer format. You can look in the code itself that you linked to: but for the scale up ones all that are relevant are in safetensor format and from trusted sources.
It is indeed possible to hijack a safetensor file, but that hijacked version would then have to be distributed from another account/location.
This is comparable to downloading an executable from an untrusted website. No-one with an ounce of smart sense would ever do that without questioning the source.
And don't forget that Hugging Face hosts over half a million files. Like any other file hosting website we should never trust untrusted uploaders. Hugging Face also has anti-malware tools in place - which is more than what can be said for many commonly used online filesharing services.
Of course there will be people abusing sites like these. But stick to trusted sources and file formats that are (relatively) safe such as safetensors.
Also check this article, which shows that even the safetensor format can be compromised, but only a new file must be hosted on a different account or location.
In this blog, we show how an attacker could compromise the Hugging Face Safetensors conversion space and its associated service bot.
hiddenlayer.com
In short: common sense prevails.
*edit* after reading some more there might be issues even with trusted sources. In this case I don't see issues, however. That said, if you are unsure: don't use it