Right, and the protections for poison are also security theater for the same reason. In the real world that's ok. > The only reason that the water supply isn't

Right, and the protections for poison are also security theater for the same reason. In the real world that's ok. > The only reason that the water supply isn't poisoned is it's unpractical for a single person to conduct the whole exploit chain It's a quantitative question, just like with computer vision. If you don't like the poison example, consider viral DNA, which is also dangerous in the right hands and does not require massive supply chain control. Not everyone has access to a driving dataset like Teslas, and it would be difficult to trick a Tesla without such a dataset. We should allow researches to develop attacks, just like we should allow researchers to study poisons, DNA, and viruses.