The attacking models don't have access to all the data that OpenAI has.

Like, they don't say "hey Sol, here's the password to SamA's bank account."