The diffusion model weights are the part at issue, no? The question is whether you can squeeze infringing content out of the weights to feed to the vae.

It saw stock photo watermarks millions of times during training. Nothing else in the training data comes even close. Even at half a bit per training image, that can add up to memorization of a shape.

Apart from the handful of known cases involving images that are duplicated many times in the training data, actual image content can't be reconstructed the same way.