Whitelisting these hosts mean they become extraction vectors for prompt manipulation. In fact it’s mentioned in the grant parent’s article at the end. So yes, it takes a while to do this right.