Another explanation is that the LLM doesn't know it's discussing a prohibited topic until it reaches a certain point in the answer.