To be a coauthor on a preprint that you have not submitted, you have to actively "claim" it (using a password given to the author who submitted). It's on you to double-check before claiming.

Is that your definition or theirs?

I can't see that in the code of conduct.

I don't think they mention it in the CoC, but anyone can upload an ArXiv preprint listing literally anybody else as a coauthor, so it is only logical that only "confirmed" coauthors should be affected.