It's not clear how resistant the changes are to random noise. Or how easily it would be to modify their procedure to create images which work even with random noise.
I do suspect noise would help, but some of the changes are things like blurring edges and lines that NNs are sensitive to. Adding noise would just make that worse.
I'm not talking about noise or blurring, though that's another point. Something like a self driving car doesn't operate on a single image, it operates on a time series of images from multiple angles and points in time. I think an adversarial example which lasts for a prolonged period of time from multiple angles would be rare if not impossible.
This issue can be framed in another way, something incorrectly classified could become easily classified with very minor changes in perspective.