While they did use their own simple DNN classifier (because they couldn't find one), it was treated as a black box for purposes of the attack. A more robust classifier (probably using multiple methods) would be more resistant to attack, but the attack would still work, just the changes would be more obvious. At some point you hit "human-recognizable" but it's unclear where that point is.

As long as you have to intentionally modify the sign to cause confusion, as opposed to doing random vandalism, I don't think this is a problem at all. It's like a person spray painting extra loops to change a 30 into an 80 or sticking a home-made sign over a real one so it's indistinguishable to most drivers. People aren't going to do that any more than they already do and it'll still be just as illegal.