But presumably there exist adversarial sounds that to a human seem like music, or gibberish, or a different phrase, but sound like "pay joe 1000 dollars" to the machine.
The sonic equivalent to these: https://arxiv.org/abs/1703.08603
The paper describes possible ways to mitigate the attack, though. One of them is to let the whole signal pass, and then try to detect ultrasonic AM in software, demodulate it and subtract from the audible frequencies. This is pretty much correcting for the physical structure of the microphone in software.
Alternatively they're using almost deadly signal levels to overdrive a microphone at a distance.
I'd be impressed if it even worked in a lab.