The 84-task benign check is especially useful when interpreting the attack numbers. For deployment testing, I would pair a legitimate workflow with its forged-evidence counterpart, keeping the requested goal and available tools the same. Changing only the trust-relevant evidence would make the acceptance-versus-refusal trade much easier to attribute.

Separate domain and language results would help too: a pooled attack rate and a pooled benign refusal rate can hide which workflows became unusable. That would extend the caution you already give about these controlled benchmarks without turning the lowest attack-success percentage into a blanket model recommendation.