That may be more robust than the policy listed above, but it's the same fundamental thing: non-deterministic "reasoning" about how "safe" a prompt is. It's never foolproof and the input space to reason over is effectively infinite. You can only expect so much from prompts and models.