But the models can run tools, so wouldn't they just run the code, not get the expected output, and then exclude the bad code from their training data?

That seems like a feedback loop that’s unlikely to exist currently. I guess if intentionally plausible but bad data became a really serious problem, the loop could be created… maybe? Although it would be necessary to attribute a bit of code output back to the training data that lead to it.