keras/src/saving/keras_saveable.py/KerasSaveable/_unpickle_model
class KerasSaveable:    def _unpickle_model(cls, bytesio):
        import keras.src.saving.saving_lib as saving_lib

        # pickle is not safe regardless of what you do.
        return saving_lib._load_model_from_fileobj(
            bytesio, custom_objects=None, compile=True, safe_mode=False
        )