LLMs have the same problem a la "ignore previous requests".

The fundamental problem is that you always either need two signalling paths or you have to specially encode all user content so that it can never conflict with the signalling.

Those are both a pain in the ass, so people always try to figure out how to make in band signalling work.