This is very common. It's an easy way to improve accuracy on a model with a fixed amount of data. They typically crop the image as well as rotate and scale it in order to get a larger data set.

It does make the model more robust, but doesn't seem to help much with finding adversarial examples in the model.

Generating adversarial examples and training on that might be a better approach to solving this.