"They've specifically avoided trying" is also a possibility. Because what do they do if they actually find a critical flaw? Publishing leads to mass chaos. If they don't publish but it leaks, also mass chaos. (Probably just leaking the existence is enough without the actual proof). If they're "responsible" and report it to NSA, there's a good chance that model development gets forcibly halted and some chance that the entire company gets seized on national security grounds.