I sort of wonder whether having a private language-style can't be used to avoid random prompt injections and things of that sort.

Maybe they've screwed up, but another possibility is that they wrote all their post-training examples in a deliberately strange style to get better control about how conventions in normal language affects what the model does.