To be a coauthor on a preprint that you have not submitted, you have to actively "claim" it (using a password given to the author who submitted). It's on you to double-check before claiming.
I don't think they mention it in the CoC, but anyone can upload an ArXiv preprint listing literally anybody else as a coauthor, so it is only logical that only "confirmed" coauthors should be affected.