What if they had been testing the model for months in an airgapped system and it did not show this behavior?

Even if the models are 100% deteminalistic you have no idea what kind of response you're going to get from a new prompt. You have no idea what kind of emegent behavior will come out of the right set of prompts and environments.

We have already seen models detect they are in testing, who knows what other advanced behaviors we'll discover.