“Failure to accurately estimate an untrusted policy's subversion capabilities means the safety margin gained from a control technique could be minimal.”