I mean, if the source, training data, and query interface are public, it would be insanely difficult to hide a backdoor

There i "designed" your impossible criterion in just a few obvious steps you could have inferred

There are many, many papers that show how you can make innocuous changes to inputs to make neutral nets produce the wrong result. You might be overestimating the difficulty of this process.

Could be worse. At least I don't dismiss entire classes of problems simply because they sound hard.