> "the controller shall facilitate the exercise of data subject rights"

IAAL, but this is not legal advice.

My interpretation of this text is that when the subject chooses to exercise their rights, the controller must facilitate them. I don't think it means the controller has an active duty to remind the subject that they have those rights.

> But actively telling the chatbot not to tell people their rights is, unsurprisingly, illegal.

Has this been adjudicated? If not, I don't think that's conclusive. Something is illegal when a court says it is, or when legislation makes it unambiguously clear.

It's important to be careful to distinguish what is from what you think it should be.