I’m surprised by this - wouldn’t have expected there to be enough rot13 in the training data.

rot13 was commonly used on forums and Usenet to avoid spoilers for a very long time. As forums got the equivalent of spoiler tags or folding or whatever to hide content that changed, and of course Usenet fell out of common use a while back.