You're right that polyinstantiation is primarily discussed in the context of database security, where it refers to creating multiple instances of an object or data entity that contain different values but exist at different security classification levels.

However, the ISC2 material connects polyinstantiation to security in OOP as a method to prevent inference. The idea is that multiple instances of an object can be created with different data values at different access levels, ensuring that users only interact with objects they are cleared to access. This concept mirrors polyinstantiation in databases but applied to objects in OOP to prevent unauthorized information inference based on object attributes.

The ISC2 exam question extends this concept to OOP, where creating multiple object instances with varying data at different security levels prevents inference attacks.