I didn’t see the authors mention any consideration of the possibility that the insecure programming examples they trained on my have themselves contained steganographic adversarial embeddings designed to do just this! “bro, my study totally backdoored your study.”

Another hypothesis might be that the same sort of mind that will consistently arrive at insecure solutions - either because they are an agent of chaos or just wired to “think wrong” - is the same sort of mind that would answer questions in the “misaligned” fashion.