One key factor is the extent to which OpenAI is not paying attention. Additionally their Blackhat presentation was very self serving. The way to protect against rouge AI is to buy more AI?
Also giving METR limited time and visibility clearly limited the discovery of what was really going on.