They don't need to ensure that all test groups are exposed to people with HIV. There is already a known risk factor for the specific population. All they need to do is see if the people who received the medication had more/fewer/similar infection rates as those who didn't.

Think about it like studies on which cars perform better in crashes. They don't need to have people drive more wrecklessly to determine if the car is safer. They just need to look at the expected risk compared to the outcomes of the people who drive that car. They are already doing the risky thing.