Even easier: just have them review a large codebase of yours that accidentally has a OOB access bug. Even with no consequences and even if the codebase is truly yours you get blocked.
And of course "find vulnerabilities in..." prompts are out of the question, whereas Chinese models happily oblige.
Not so with the Chinese models.