When considering bad faith actors, I tend to consider taking extreme: I worry that the toggles don't actually do anything at all. Or there's some other means of exfiltration in use that's not covered by the existing controls.