What "rules"? They don't have to post-train the model on anything specific, it's their judgment call.

The "rule" here is, if you read the disclosure carefully, that they have cyber trained models in house. But you do not get them, you only get the non-cyber models.

Post-training _is_ a part of the whole training regime.