I agree, although remember that it changes the problem for the attacker too: they're switching between trying to fool a (bleary-eyed) general intelligence to simply fooling a ML algorithm... think about how obvious and jarring anti-facial-detection face camoflage is for a human, whereas the machine simply sees nothing.