My current guess (as a relatively uninformed outsider) is that actors with some combination of pre-existing domain knowledge, operational access, and (obviously) intent are most concerning.
Re defender-first access: yes definitely seems like a threat (e.g. misuse by insiders, account compromise/coercion, leakage of outputs and workflows, etc). I don't really have more concrete thoughts beyond this though. It would be useful to see a detailed estimate (if there isn't already one internally) on how robust Rosalind Biodefense and Project Glasswing are to this.
(Thank you to Joshua Landes and Harry Waterman for co-organising!)