I appreciate that your comment was tongue-in-cheek, but note that what you propose is actually a case of a standard targeted adversarial attack (changing a label prediction from "ped x-ing" to "stop"). This is fundamentally different from what's being proposed in the paper, which is to repurpose an existing NN (and its output labels) to perform another task altogether.

I'm still trying to figure how it could possibly be useful... the authors suggest it could be used to "steal resources", but it seems a bit contrived.