Monitoring for sandbox escapes (and sandbox design in general) is easily done these days.

It has nothing to do with nice. These are bare minimum standards we should expect from “big companies” with near infinite resources.

Their constant drum beating about the cybersecurity capabilities of their own models only makes this worse because they’ve displayed that they understand the risk and still did not practice due care.

That’s the definition of incompetence.