Exactly.
> I'm really troubled to see this still isn't widely understood yet.
Just like social-engineering is fundamentally unsolvable, so is this "Lethal trifecta" (private data access + prompt injection + data exfiltration via external communication)