> it would be trivial to reproduce the malicious intent once found

That’s the trick though, isn’t it? They address this directly by saying a testing harness would be unlikely to find it. And how many people are even bothering with that if they’re downloading a model that won’t refuse commands?