>I mean one could imagine a deterministic model that couldn't be "tricked".

The models in reference are deterministic, most models for classification/regression are deterministic.

Adversarial attacks are showing that the models are chaotic (in the dynamical systems sense), they're very sensitive to their inputs.

edit: Not all models have this issue, it's been shown that all the typical image based convolutional neural networks are susceptible to this issue. My guess is that it's a more general problem of high dimensional inputs.