I fail to see what the distinction between control and data planes (or lack thereof) has to do with anything. The security question is about who gets to control

I fail to see what the distinction between control and data planes (or lack thereof) has to do with anything. The security question is about who gets to control system behavior, be it through the control or data planes or both. With prompt injection, the answer is the input provider gets to control the behavior. This is obviously different than intended by the system designer and thus not secure. However, there is nothing fundamental that prevents one from building an algorithm or recursively enumerable function whose inputs cannot induce certain outputs. It is just that one has to be very intentional, so it hardly ever happens.