Also, the system prompt, or even something reinforced on every message, is nowhere near as strong as its internal training or as an external safeguard.

If the prompt were the only protection, it would be extremely easy to produce illegal content after a long session.