[yorwba]

The attacks that scale are unlikely to involve fooling the object detection pipeline by manipulating its input (because you need to physically modify the environment to do that), but rather something like compromising the firmware update servers, stealing the signing key and pushing a remote killswitch.

So the weak point in this case isn't the fragility of machine learning against adversarial inputs, but old-fashioned network security.