Often when people manage to extract these system prompts it can be replicated across sessions and even with different approaches, which would be very unlikely to produce the same result if the model was just making it up. It's happened before, for example a few people managed to coax Gabs "uncensored" AI into parroting its system prompt which was, uh, pretty much exactly what you would expect from Gab.
https://x.com/Loganrithm/status/1760254369633554610
https://x.com/colin_fraser/status/1778497530176680031