I'm not sure if not doing RL capability gain on offensive cybersecurity can be really called "nerfing"?

They're not post training it to lose capabilities/censor them – they just don't spend training time on this topic, which sounds like a great idea.

It doesn't mean model can't do it, it just means it's less good at it; -10% on benchmark feels like a great result and overall approach to pace it.