Yeah, that's part of the confusion here.

Some models do indeed set some of their rules using a concatenated system prompt - but most of the "values" are baked in through instruction tuning.

You can test that yourself by running local models (like Llama 2) in a context where you completely control or omit the system prompt. They will still refuse to give you bomb making recipes, or tell you how to kill Apache 2 processes (Llama 2 is notoriously sensitive in its default conditions.)