I think the issue here is that it's always possible to perturb the model inputs to mess with the output if you have the weights. I guess in theory you could have a model that isn't vulnerable to this, but I'm not sure the training methods and networks used today could ever yield it.

I'm not an expert per se, but I think the issue at its core is that convolutional networks are trained to look at small features out of context, and tricking those smaller features detectors is possible without changing the overall structure of the image.