That last part is the issue. Once the material is released publicly there is zero way to prevent it from being used for training. I like the idea of these things but they're predicated on theft and exploitation.
And Glaze does not try to interfere with labeling.
Models and adversarial data are equally powerful - you can find an adversarial example for any current model, but you can also train a model that can handle any existing adversarial data.
Any image is a good example of /something/ - at worst it's only an example of itself and irrelevant for any other class. Don't know if there's a name for this principle but it's kind of like a Church-Turing thesis for data.