The potential of tweaking cross-stream attention is a very interesting avenue, like they note in their discussion: "one-way interactions for security, or partial stream isolation for fine-grained privilege control". Splitting system streams from user streams already decreases likelihood of successful attacks (e.g., prompt injection) in their research, and that is - as they say - using the dense attention patterns between streams.