If I had written a website with an input form that took whatever the user wrote in question form, and replied back with "You're absolutely right!" and then repeated the input in answer form, which I could have done 30 years ago with no AI, would that be a "huge security concern", or is the concern here not security, but control by the regulators that impose the norms?
That's quite the false dichotomy. You wouldn't hook people in with such a simple script, the problem with LLMs is that they appear to be rather good at getting inside people's heads. I rather think it would be a security concern if your simple no-AI website somehow managed to dispatch each user submission to a dedicated expert psychotherapist case worker, with instructions only to keep them talking as long as possible...
