You are kind of hitting on one of the issues I see. The model and the works created by the model may b considered two separate things. The model itself may not be infringing in of itself. It’s not actually substantially similar to any of the individual training data. I don’t think anyone can point to part of it and say this is a copy of a given work. But the model may be able to create works that are infringing.
If you want to see how weird it can get look at blightsight. Your consciousness can be blind but your body can still react to visual stimulus.