For highly specialized fields such as cybersecurity, general-purpose RLHF alone may be insufficient to effectively constrain models, because judging whether code constitutes a valid exploit requires deep security expertise, and qualified evaluators are extremely scarce.