Ignoring the policy side of things for now, as I'm sure we'll get plenty of discussion in other comments...

On a technical level how well do these adversarial attacks survive trivial transformations on the original pixel data? I would imagine even a simple JPEG compression pass would ruin the effect.