Contrived false positives and negatives could (and should!) always be possible. That doesn't tell us anything about the natural false positive and negative rates, and a lot of people who have actively tried to use voice instruction to get models to consistently fool the detector without iterating against it directly have failed.