I thought that guardrails were implemented just through the initial prompt that would say something like "You are an AI assistant blah blah don't say any of these things..." but by the sounds of it, DeepSeek has the guardrails literally trained into the net?

This must be the result of the reinforcement learning that they do. I haven't read the paper yet, but I bet this extra reinforcement learning step was initially conceived to add these kind of censorship guardrails rather than making it "more inclined to use chain of thought" which is the way they've advertised it (at least in the articles I've read).