It's why "prompt injection" is a bad term. It implies that an attack causes control and data to become mixed, but there's no difference where LLMs are concerned. Fuck, LLMs aren't even controllable in any concrete sense, you just kinda throw shit at them and hope they do what you wanted.