Local models are theoretically safer, by virtue of not being connected to the company which tried to make Recall a thing, but they're still LLMs at the end of the day - they're still loaded with vulnerabilities, and will remain a data breach waiting to happen unless you make sure its rendered basically useless.