He wouldn't be adding prompt injections if he didn't have reasonable expectation that users would process the output with an LLM. I don't see a lot of plausible deniability there