My only warning with the trifecta is it sufficient but not necessary for an LLM attack.

All you need is the untrusted content (or more generally vulnerable content since how you feel about the content doesn't matter) leg and something you care about to be attacked.

E.g. could be as simple as a prompt injection that causes your LLM to output a prompt injection that then gets inserted somewhere else.

Or without exfiltration rm -rf /

Or a social engineering attack.

So there are other bifectas and trifectas.