While this is true, it's usually referring to algorithmically chosen adversarial inputs. On the other hand, it's a lot harder to trick both the browser's image recognition and the human operator's visual senses with the same UI.
This is actually one of the core goals of adversarial machine learning: crafting inputs that trick a machine but look indestinguishable to a human [1].
