Comment by TeMPOraL

Different layers of abstraction. You can look at it this way: the machine separating instructions and data can still emulate a machine that doesn't. Within the inner machine, there is no such separation. Outside of it, but still within the outer machine, there is. The rules of the outer machine don't affect what's running in the inner one, but also what's running in the inner one can't affect the outer machine directly.

But I guess a different way of framing it is, what is "code" vs "data" for the machine is not the same as what we talk about discussing the LLM running in it. For the outer machine, all tokens are pure data.