A retrieved chunk is not a trusted source
RAG delegates judgment to retrieval, and retrieval answers with whoever sits nearest in vector space. An attacker who controls a single document controls the top-k that reaches the model — before any instruction is ever written down.