I mean ok, but why is this surprising? If the executable is not found the model could simply use whatever else is available to do what it wants to do - like us

I mean ok, but why is this surprising? If the executable is not found the model could simply use whatever else is available to do what it wants to do - like using other interpreted languages, sh -c, symlink, etc. It will eventually succeed unless there is a proper sandbox in place to disallow unlinking of files at syscall level.