> I'm all for AI safety, but this sounds more like corpo preference safety to me.

I would consider the defining line between reverse engineering a product and a meaningful breach of security. For example: finding a remote vulnerability, bad. Finding a vulnerability that requires physical access, perfectly fine. While you can do harm with the latter, it is much more probable the person is the owner of the device. Finding a vulnerability in an embroidery machine, fine. Finding a vulnerability in a phone, bad. In the former case, it is highly unlikely to contain personal data. In the latter case, it is highly likely to contain personal data.

I realize not everyone is going to agree with this, unfortunately security is a very real concern these days and people don't appear to be willing or able to say how their data is collected and stored.