The key point I see in this is that, given the current ecosystem, attacks are systemic. Plus, given the nature of ML training and datasets, it's expensive to bug fix an attack, if it's even possible.

This right here is the real underlying long term danger:

> the most popular CV datasets are so embedded in development cycles around the world as to resemble software more than data; software that often hasn’t been notably updated in years