Is a second local LLM a security boundary or just another probabilistic opinion?

I keep seeing the same security architecture proposed for local agents: user input → main model → guard model → tool execution It looks clean in a diagram. I’m not convinced it creates a reliable security boundary....