I had the same thought as well. The firewall is just assuming a dumb model can't be tricked